In real life, if you are suspicious of every single person you ever meet and expect them to verify who they are each time you see them, you might end up feeling a little lonely.
But when it comes to cybersecurity in the corporate space, the mantra ‘never trust, always verify’ is one that should realistically be followed by every company, particularly in an age where security breaches are on the increase, explained David Rihak, co-founder and CEO at Peig.
“In the real world we are rarely unsure of who it is that we are dealing with, but we are almost always unsure of their intentions,” Rihak said. “Online, we are unsure of both who we are dealing with and their intentions. People believe more in cybersecurity than they did before, but we are seeing more successful breaches. Why is that?”
According to the 2025 Verizon Data Breach Investigations Report, around 88% of web breaches are done through the use of stolen credentials, and ransomware demands have increased from 2% of breaches seven years ago to around 44% today.
Rihak added that although many people see zero trust as a buzzword, it is in fact something that all firms should be increasingly adopting for their own benefit, rather than relying on a more outdated attitude of ‘turn on multi-factor authentication (MFA) for everything.’
“It doesn’t matter to adversaries if MFA was present at the time of attack, they can just bypass authentication once they have access,” he said, explaining that they key is to look at security through a different lens.
A Different Perspective
Device-bound access is fast becoming a weapon of choice in the fight back against cybercriminals, who are trying every avenue available to steal identities and credentials of individuals to gain access to sensitive corporate information. It works by linking a user’s account or network access directly to a specific device, which in turn prevents unauthorized access even if credentials are stolen by acting as a second layer of security beyond a password, which means attackers cannot log in using a password alone because they would need the physical device as well for authentication.
With around 40 billion devices in use around the world, companies are facing a huge challenge in perimeter security. For instance, in an online poll 40% say they used four or more devices for work purposes.
Rihak said companies need to look at security with a different perspective. “We want to make sure people have access from any device, but it is about how we ‘do’ access security. Do we use a ‘device print’ and pair it with devices so we know who is using the system? This could change how we think about security and account takeover,” he said.
“[It means we could] look at social engineering theft as a network security design problem rather than human error and use device-bound access and session cookie security instead,” he said.
How should your company implement this and avoid storing potentially dangerous session cookies (which don’t require re-authentication and can give cybercriminals open access to information) when browsing? Rihak has three tips:
- Don’t use persistent cookies whenever you can because it decreases the attack surface and exposure of access to resources.
- Make it harder for adversaries to get their hands on session reviews by opting for a device-bound strategy.
- Enforce private browsing where possible, meaning session cookies are not stored long-term and they are harder for adversaries to access.
As attackers increasingly sidestep passwords and MFA alike, organizations need to rethink what trust really looks like in a zero‑trust world. Device‑bound security offers a practical way forward: Shifting the focus from endlessly authenticating people to verifying the devices they use and reducing the impact of stolen credentials altogether. By combining device‑bound access with smarter session management, companies can strengthen their defenses without adding friction—making security less about blind faith, and more about confidence by design.
Looking for cybersecurity expertise and support?
GTIA members, log into the Cyber Hub on the Member Portal.
Not a member yet? Join now!
