Does this replace CAC or PIV cards?

No. It works alongside your existing CAC or PIV infrastructure, adding session-level verification after the login event those credentials already secure.

Does Proximia get us to an ATO?

It supports the identity and authentication-layer requirements within a broader ATO package; it is not itself an ATO.

Is Proximia FedRAMP certified?

FedRAMP is not a current certification. Proximia works with FedRAMP-accredited advisory partners and can pursue authorization if a specific procurement requires it.

Can this work across multiple agency sites for contractor staff?

Yes. Authentication is workstation-based, so it is identical regardless of physical location, as long as the workstation meets hardware requirements and is enrolled.

Does Proximia support SAML or OIDC-based applications for federal use?

Yes. Entra ID and Active Directory integration with SAML-based application support is confirmed live today, with OIDC-based application support also available through the same integration.

Does Proximia secure our OT or SCADA systems?

No. Proximia secures Windows-based IT workstations only. It does not replace OT or ICS-specific defenses, and it does not replace the network segmentation NERC CIP-005-7 separately requires.

Would this have stopped the Minnesota water attacks?

As reported, those attacks targeted internet-exposed PLCs directly using default credentials, a different layer than the IT workstation authentication Proximia secures. The relevance here is closing the same category of credential-hygiene failure at the IT layer before it can become a foothold, not a claim about that specific incident.

Can this work in a control room where downtime is not tolerable?

It deploys per workstation without requiring a broader infrastructure change, though this has not yet been independently validated in a control-room environment specifically, since no active utility customer deployment exists at this time.

Does deploying this make us NERC CIP compliant?

It supports the MFA requirement specifically within NERC CIP-005-7 Requirement R2.2. Overall NERC CIP compliance is assessed across many requirements at the utility level, not certified at the vendor level.

What about utilities outside electric, like water or gas?

Water utilities fall under a different framework, the Safe Drinking Water Act Section 1433 and America's Water Infrastructure Act Section 2013, rather than NERC CIP. The underlying credential-hygiene problem EPA has documented applies across subsectors even though the specific regulatory driver differs.

Doesn't MFA already stop most attacks?

It stops most attacks aimed at the login event. The 2026 DBIR shows attackers increasingly bypassing it altogether by targeting the session that follows instead.

What is session hijacking, exactly?

It is the theft and reuse of a session token, cookie, or OAuth grant that represents an already-authenticated session, letting an attacker act as that user without ever needing the original password or MFA prompt.

Does this mean my current MFA is useless?

No. MFA remains valuable at the login event; the gap is specifically what happens to the session afterward, which MFA on its own does not address.

Does Proximia protect cloud application sessions like Microsoft 365?

Proximia continuously protects the local workstation, RDP, and VDI session. Sign-in protection, no password, no phishable prompt, extends to SAML-based applications, but the ongoing session for a federated web app like Microsoft 365 is governed by that application's own token lifetime once sign-in completes.

What is the difference between identity verification and presence verification?

Identity verification confirms who signed in, once, at the start of a session. Presence verification confirms someone is still physically there, continuously, for as long as the session stays open.

How much does a single password reset really cost?

Roughly $70 in help desk labor, according to Forrester. That figure does not include the employee's own downtime while locked out.

What percentage of help desk tickets are password-related?

Between 20 and 50% in the average enterprise, according to Gartner.

Does a self-service password reset tool solve this?

It reduces the cost per ticket, but it does not eliminate the ticket category, since the underlying cause, a user-managed password, is still there generating new tickets over time.

How fast is Proximia's sign-in compared to typing a password?

About two seconds, up to 18 times faster than a typical password-plus-push or OTP flow, based on internal testing benchmarked against published industry timing studies.

How long does deployment take?

Initial configuration typically completes in under two hours per workstation, and onboarding averages about six minutes per person, with a dedicated Customer Success Manager assigned to every account.

Is a CISO legally liable if their company gets breached?

Generally, simply having a breach happen is not itself a crime. Legal exposure has arisen specifically around how a breach was handled or disclosed, as in the Uber case, rather than from the technical failure alone. This is general, publicly reported information, not legal advice; specific liability depends on jurisdiction, role, and facts, and any organization facing this question should consult its own counsel.

Did the SEC's case against SolarWinds' CISO succeed?

No. A 2024 court ruling narrowed it substantially, and the SEC dismissed the remaining claims in November 2025 without a settlement. Individual executives still face scrutiny from other sources, including state regulators, private litigants, and criminal exposure in cases involving mishandled disclosure.

Why does the CISO usually take the fall even when the breach was not their direct failure?

Because the CISO role is accountable for controls, monitoring, and incident response, boards and the public tend to look there first, even when the root cause traces to a vendor or an unpatched system outside the CISO's direct control.

Can reducing credential-based risk actually reduce personal accountability exposure?

It reduces the number of preventable incidents that trigger the accountability conversation in the first place. It does not eliminate an executive's responsibility for other decisions, such as disclosure timing or overall governance.

What roles besides the CISO face career risk after a breach?

CIOs, typically tied to infrastructure or patching failures; CEOs, tied to how disclosure and public response are handled; General Counsel, tied to flawed regulatory reporting; and Chief Risk Officers, tied to cyber risk that was not escalated to the board.

What does passwordless authentication actually mean?

Passwordless authentication replaces a user-managed password with a cryptographic credential bound to a device or a biometric. The important question is whether a user-known password still exists somewhere as a fallback. Many platforms marketed as passwordless keep one, which means the credential attack surface is reduced rather than removed.

Can an organization be fully passwordless today?

Rarely, and not quickly. Most environments include legacy platforms, VPNs, and remote desktop sessions that cannot support modern protocols, or that sit behind vendor release cycles and compliance freezes. Those systems keep fallback credentials alive, which is why session-level protection matters more than chasing complete coverage.

We already have MFA. Is that not enough?

MFA protects the sign-in event and does nothing to protect the session that follows it. The Verizon 2026 DBIR documents attackers stealing session tokens and OAuth credentials to bypass MFA entirely, without defeating the authentication step. Proximia protects the whole session and eliminates the credential, so there is nothing left to phish.

Does this require replacing our existing identity platform?

No. Proximia integrates with Active Directory and Entra ID rather than replacing them, using a lightweight agent. It is SOC 2 Type II certified and HIPAA aligned, and it supports FIDO2 and WebAuthn.

What happens to a session when the user walks away?

The session locks within seconds of the user leaving the administrator-configured proximity zone, which is typically five to thirty feet. Returning requires the user’s biometric again. Proximity alone never grants access; it is always combined with biometric identity and mutual device authentication.

What is authentication total cost of ownership?

Authentication total cost of ownership is the full cost of running an authentication platform over its life. It includes licensing and infrastructure, and also help desk labor, enrollment and recovery support, and the working time users spend signing in. Most vendor TCO models count only licensing and infrastructure.

Why do help desk tickets stay high after moving to cloud MFA?

Because cloud delivery changes where the platform runs, not how often it prompts the user. Resets, enrollments, recovery flows, and repeated approvals all continue at the same rate. Password-related issues still account for 20 to 50 percent of help desk tickets in the average enterprise (Gartner).

We already have MFA. Does that not solve the cost problem?

MFA protects the sign-in event. It does not reduce the number of interruptions, and in most deployments it adds to them by introducing a second authenticator to enroll, carry, and recover. It also introduces its own risk: 1 in 3 users approve fraudulent MFA prompts when distracted (Microsoft Security Research).

How long does a sign-in actually take?

A five-week field study of live corporate sign-ins measured password plus one-time code at 21.59 seconds on average, and security key with biometrics at 16.54 seconds (Lassak et al., SOUPS 2025). Be careful with published figures that look faster: many measure the second factor only and exclude password entry entirely.

Does removing prompts weaken security?

No, provided the prompt is replaced by something stronger rather than by nothing. Proximia verifies the user with live biometrics at sign-in, then confirms continuous presence through the XiFi Card or phone for the length of the session. Proximity alone never grants access, and the session locks automatically when the user walks away.

What is authenticator sprawl?

Authenticator sprawl is the accumulation of more authentication methods than a workforce can reasonably manage: a phone app for one system, a security key for another, backup codes, and a password still underneath as the fallback. It is measured by the number of distinct things a person must keep working, not by the number of factors in a policy.

Why did our help desk tickets go up after deploying passwordless?

Because most rollouts add a method before they retire one. The old method cannot be switched off until every dependent system is migrated, so during the overlap the workforce carries both and the help desk supports both. Ticket volume falls when a method is retired, not when one is added.

Which support requests does authenticator sprawl actually cause?

Four: initial enrollment, re-enrollment on a new or replacement device, recovery of a lost or broken authenticator, and fallback when a method fails. Recovery is the most expensive, because it needs a human to prove identity when the thing that would normally prove it is missing.

Is sprawl a security problem or just an operational one?

Both. Every additional authenticator adds prompts, and constant prompting trains people to approve without reading. 1 in 3 users approve fraudulent MFA prompts when distracted (Microsoft Security Research).

How does Proximia reduce the number of authenticators?

It replaces the collection with one credential the user does not manage. A live biometric at sign-in, then continuous presence verification through the XiFi Card or phone. Enrollment happens once rather than per system, and no user-known password exists as a fallback.

Next-generation authentication blog

Step into the future of security with Proximia. Get inspired by the latest industry trends and empower your business to thrive in an increasingly interconnected world.

Stay Updated

Get exclusive access to new articles, industry news, updates, and more.

SUBSCRIBE TODAY

Transcending the Token: Presence Over Possession

September 24, 2025

Proximia transcends traditional token-based security by delivering a solution that is as dynamic as today’s working environments: one that is stronger, more private, and infinitely more user-friendly.

Transcending the Token: Presence Over Possession

September 24, 2025

All
Authentication
Cybersecurity
Healthcare
MFA
Passwordless
Public Sector
SMBs
Zero Trust

Person working at standing desk using persistent authentication

Security vs Usability: End the Trade-Off

September 24, 2025

For decades, stronger security has meant worse usability, and traditional phone-based MFA breaks down wherever ...

Proximia Leads the Future of Authentication

October 8, 2024

Proximia is a persistent, presence-aware authentication platform that replaces one-time logins and traditional MFA with ...

Zero Trust Secures the Login. What Secures the Session Afterward?

September 15, 2026

CISA's Zero Trust Maturity Model requires phishing-resistant MFA to reach its Advanced stage, and OMB ...

Volt Typhoon Is Already Inside U.S. Utility Networks. Is Your Control Room Ready?

September 10, 2026

CISA and the FBI have confirmed that Volt Typhoon, a Chinese state-sponsored threat group, maintains ...

Your MFA Worked. The Attacker Got In Anyway.

September 8, 2026

The 2026 Verizon Data Breach Investigations Report documents a pattern it calls authentication bypass: attackers ...

What 20-50% of Your Help Desk Tickets Are Actually Costing You

September 4, 2026

Password-related issues account for 20 to 50% of all help desk tickets in the average ...

Who Actually Gets Held Responsible When a Breach Happens?

September 1, 2026

Breach accountability increasingly reaches beyond the IT budget and into individual careers: CISOs, CIOs, and ...

Passwordless security concept with keywords

Passwordless Isn’t Fully Here: Why Hybrid Environments Need Continuous Protection

May 4, 2026

Passwordless authentication replaces user-managed passwords with cryptographic credentials bound to a device or a biometric. ...

The HIPAA Security Rule Update: What Changed, What Slipped, and How to Prepare

March 4, 2026

CHANGE PUTS ALL YOUR CHOICES TO THE TEST HIPAA Security Rule Is Getting A Much-Needed ...

Choosing the Right Authentication Platform for Your Organization

February 12, 2026

TL;DR A modern authentication platform does more than add a second factor at sign-in — ...

Office workers using computers in a SMB business with persistent access protection

Modern Cybersecurity for Enterprise: People, Process, and Technology

February 3, 2026

TL;DR Modern enterprise cybersecurity is no longer built around firewalls and network perimeters. It centers ...

Woman using multi-factor authentication tools.

The Hidden Costs Traditional Authentication Tools Don’t Solve.

February 2, 2026

Authentication total cost of ownership is the full cost of running an authentication platform, including ...

User interacting with passwordless authentication technology.

Too Many Authenticators, Too Many Tickets: The Operational Burden of Traditional Passwordless

January 27, 2026

Authenticator sprawl is what happens when a workforce accumulates more authentication methods than it can ...

Multi-Factor Authentication: 2026 Guide to Stronger Security

January 12, 2026

TL;DR Multi-Factor Authentication (MFA) requires two or more independent proofs of identity-something you know, have, ...

Person using biometric authentication at computer.

Passwordless Authentication: What It Is, Why It Matters, and How to Implement It

January 6, 2026

Passwordless authentication replaces passwords with FIDO2-based passkeys and biometrics, letting users sign in through something ...

The Critical Security Gap: Continuous Authentication vs. Static Sign-In

December 4, 2025

Static sign-in - even with MFA, biometrics, or passwordless methods - proves identity only once, ...

Securing Courts Against Cyber Threats

September 24, 2025

Court systems face a rising wave of ransomware, phishing, and supply-chain attacks against sensitive judicial ...

Medical Cybersecurity - 6 Challenges and How to Solve Them

Healthcare’s Top 6 Cybersecurity Challenges—And How to Solve Them

February 28, 2025

Healthcare organizations face six recurring cybersecurity challenges: ransomware, compliance risk, password fatigue, shared-workstation exposure, remote ...

Healthcare Cybersecurity: Why Zero Trust Authentication is the Future

Healthcare Cybersecurity: Passwordless Zero Trust Authentication is the Future

February 27, 2025

Healthcare organizations face an evolving threat landscape that static passwords and one-time logins can no ...

What Businesses Should Ask Their MSP About Identity and Access Management

December 10, 2024

Most MSPs still rely on static passwords and point-in-time MFA checks that protect the moment ...

Is Your MFA Enough?

November 25, 2024

Multi-factor authentication raises the bar over passwords alone, but most MFA only checks identity once, ...