Why AI Era Security Needs Hardware Keys

Phishing used to be a numbers game. With AI, it’s becoming a personalization game and that’s exactly why “good enough” login security is quietly turning into a liability. We sit down with Dawn Manley, PhD, SVP, Product Management of Yubico to talk about why phishing-resistant authentication is now a must-have for anyone protecting high-value accounts, especially as AI tools become central to daily work and decision-making. 

We get specific about OpenAI’s Advanced Account Security and why YubiKeys are part of the story. AI accounts can hold an incredible amount of sensitive context: drafts, strategies, internal notes, customer data, and the breadcrumbs of how you think. That makes ChatGPT account security and account takeover prevention far more than a technical checkbox. Dawn explains how hardware-backed security keys work in real life, why they’re considered phishing resistant, and how they avoid the weak points of SMS codes, intercepted OTPs, and push-notification tricks. 

Then we zoom out to the next wave: AI agents and agentic commerce. When software can act on your behalf, the question shifts from “who logged in?” to “who approved this action?” We talk about proving human intent for high-risk moments, using strong cryptography as a trust anchor, and what it looks like to deploy hardware-backed passkeys across an entire organization without relying on users to spot every scam. 

If you care about identity and access management, FIDO2 passkeys, enterprise security, or protecting AI workflows, you’ll walk away with a clearer model for what “strong authentication” really means now. Subscribe, share this with someone still relying on codes, and leave a review with your biggest question about phishing-resistant security.

Transcript

Why Phishing Resistance Matters

SPEAKER_01 0:02

Hey everyone. Fascinating topic and guests today. We're talking about how a stronger account security in the age of AI is really dependent on phishing resistant authentication, which is becoming a must-have, not a nice to have. And we have a leader from Ubico. Dawn, how are you?

SPEAKER_00 0:20

I'm great, Evan. Thanks for having me.

SPEAKER_01 0:22

Well, thanks for being here. Big fan of your products and your work as a user. Really excited to chat. Before that, how do you describe Ubico these days and what do you focus on?

SPEAKER_00 0:37

Well, I'd like to think about Yubico as Yubico is the organization that really helps stop account takeovers before they even start. We replace vulnerable passwords and codes with hardware-backed security in authentication and authorization through our Yubiki products.

SPEAKER_01 0:56

Yeah, they're amazingly intelligent little devices. We'll get into all that. Before that, what do you do at Yubico? What's your role and your mission, your team's mission?

SPEAKER_00 1:08

Yes. Well, I lead product management at Yubico. And my role is really about providing strong, phishing-resistant authentication

How OpenAI Uses YubiKeys

SPEAKER_00 1:16

and authorization in the real world. As leader of product, I partner very closely with our go-to-market and engineering teams to anticipate and build what our customers need next in order to protect their organizations and increasingly the AI workflows they depend upon.

SPEAKER_01 1:36

So critical. Sounds amazing as a big fan and user myself, including their new work product, which just came out uh this week. How did this uh come together between Ubico and OpenAI?

SPEAKER_00 1:56

Well, it was a really a natural evolution because OpenAI uses YubiKeys internally, and they wanted to extend that same level of protection to their own uh to to their uh they wanted to extend that same level of protection for the users of their products. So OpenAI announced advanced account security, which provides an advanced set of protections for sensitive information inside of Chat GPT. Users can secure their accounts with YubiKeys, including a special two-key bundle. It's critical because AI accounts are extremely valuable. As people put more of their work, ideas, and context into these tools, protecting access is really about protecting the people and organizations behind those accounts. So, as an example of how important this is, OpenAI just took this a step further. They added additional requirements to their trusted Access for Cyber program. Those individuals are now required to use hardware-backed pass keys so they can continue to have increased access to those frontier cyber models.

SPEAKER_01 3:05

Fantastic. And for those who may be watching and not familiar, what exactly is this uh little UV

What A YubiKey Actually Does

SPEAKER_01 3:12

key? How does it work? And why is it considered phishing resistant?

SPEAKER_00 3:17

Well, uh, you and I both have uh several on our persons at any time, right? As you see, as you showed, there's one that's about uh it's smaller than a house key. And then there's a second one, the nano, that is about the size of you know my fingernail. So you could hardly see it in my hand. So think about the YubiKey as a compact physical security key. Um, it safely stores your digital credentials to verify your identity when you log in or when you authorize an action. So when you sign into a device or a platform, you plug it in or tap it against your device. It uses advanced cryptography to prove who you are. And because it's hardware-based, there are no codes for a hacker to intercept, uh, no SMS text to hijack and no malicious push notifications designed to trick you. Think about it like a physical start button for the critical workflows and AI sessions that you have. You're proving that you're physically present and that you're authorized to access your account.

SPEAKER_01 4:24

Yeah, amazing. Uh hardware-based authentication, really different from texting and authentication apps, although I use those as well, a completely uh different approach, uh, much more secure. So why Ubico?

SPEAKER_00 4:37

We'll have to have you go fully Yubico, fully Yubiki.

SPEAKER_01 4:42

Uh I I will, I think, uh once I get uh my next phone, because I'm still wedded to my my phone number. But um, you know, why was Ubico the right fit for OpenAI and this advanced account security program? What sort of brought you two together?

SPEAKER_00 4:59

Well, as I mentioned, OpenAI already uses YubiKeys internally. So this was really a natural progression. We've spent years helping organizations move beyond legacy authentication to phishing resistance security. And what's exciting about this partnership now is the scale and timing. As AI is becoming a part of everyday work, OpenAI is helping to bring stronger account protection to the environment in a way that's really practical for their users.

SPEAKER_01 5:31

And this is much bigger, of course, than just OpenAI. It's about protecting my entire digital footprint. Uh, how does it help protect users in the sort of broader AI ecosystem?

Identity Stakes Rise With AI

SPEAKER_00 5:44

Well, I think that, you know, as AI moves from a tool we use to something that can really act on our behalf, the stakes for identity get much higher. It's not only who logged in, it becomes who authorized this action. And can we trust that a real person approved it as opposed to a bot? And that's where Yubico has a really important role to play. A YubiKey can help provide that cryptographic anchor for those high-risk, high consequence moments.

SPEAKER_01 6:17

Amazing. So looking at the bigger picture in terms of enterprise-wide security, um, do you see this raising the bar in terms of digital threats? And how easy is it to secure, deliver UVTs enterprise-wide to hundreds or thousands of employees?

SPEAKER_00 6:36

Well, let me answer

Enterprise Rollout And AI Phishing

SPEAKER_00 6:38

your first question first, right, right? Which how is this changing the game for digital threats? Phishing is getting ever more sophisticated and easier to scale and getting more personalized. Uh, AI makes those attacks even harder for people to recognize. So the game changer is this as we move away from security models that rely too heavily on users detecting the threats, we want to shift instead to using phishing-resistant technology that stops those attacks even before they can start. So looking forward, this becomes even more important as AI agents begin acting on behalf of users. We won't authenticate every tiny action an AI and an agent takes. Um, but for those high-risk moments, like authorizing a sensitive workflow or proving a major transaction, we need a way to verify there was a human intent behind it. And that's where hardware authentication becomes incredibly powerful.

SPEAKER_01 7:43

Fantastic. Well, they're super easy to travel with, uh, much lighter than a car key or something you can you can put in your wallet pretty easily as we as we travel to Black Hat coming up.

Final Takeaways And Black Hat

SPEAKER_01 7:55

Um, any additional takeaways or insights you'd like to share before we wrap it up?

SPEAKER_00 7:59

Well, Evan, I look forward to seeing you at Black Hat. Uh Ubico will certainly have a presence there. And I think that if I could leave you with one major theme, it's really that uh multifactor authentication with passwords and codes really is not enough for the world that we live in today with the advanced roles of AI and agent agents and agentic commerce. It's really critical to use a hardware backpass key to protect your accounts.

SPEAKER_01 8:29

Well, on that microp moment, I think you said it all. Uh, folks listening, check out Ubico and check out their Yubi Keys and um check out the latest news uh at Black Hat. It's going to be quite a blockbuster event in this day of cyber threats and phishing. Some great learnings and insights are expected to come up. Thank you so much, Sean, for for joining. And uh nice chat. Thank you. Thanks, everyone. Yeah, thanks everyone. Uh see people in Vegas and take care.

SPEAKER_00 8:57

Thank you.