Passwords Are Getting Easier to Fake. Device Trust Is the Fix Companies Are Reaching For.
As AI turbo-charges phishing and credential theft, the old signals that told a company 'this login is fine' are quietly failing. Here's what's replacing them.
Key points
- AI tools are making phishing emails and fake login pages cheaper, faster and far more convincing in 2024 and 2025.
- Traditional login checks like passwords, multi-factor codes, IP address reputation and country-of-login can all be bypassed by a determined attacker.
- Companies are adding "device trust", a check on whether the actual laptop or phone logging in is a known, healthy company device, to their security stack.
- Device trust is a core piece of Zero Trust, the security model that assumes no user or machine should be trusted by default.
- The shift matters for ordinary staff because logins from unknown devices may now be blocked outright, even with the correct password and code.
The login box has been the front door of corporate computing for thirty years. That door is getting easier to pick.
Generative AI, the same technology behind chatbots like ChatGPT, has quietly handed attackers a productivity upgrade. Phishing emails, the fake messages criminals send to trick staff into typing their passwords into a lookalike website, used to be easy to spot. Bad grammar. Weird logos. Not any more.
An analysis by password-security firm Specops, flagged this week by BleepingComputer, argues that the checks companies have relied on for years to spot a dodgy login are quietly running out of road. The fix they point to is device trust.
What is device trust, in plain English?
Device trust means the company checks the machine, not just the person. Before letting a login through, the system asks: is this the laptop we issued? Is it patched? Does it have our security software running? If not, access is refused, even if the username and password are correct.
Think of it like a nightclub that checks both your ID and the wristband it gave you at the door. Steal one, you still don't get in.
Why are the old checks failing?
Because every one of them can now be faked cheaply. Passwords get stolen in bulk breaches and sold. Multi-factor authentication codes, the six-digit numbers texted to your phone, can be intercepted or phished in real time using attacker-in-the-middle kits like Evilginx.
IP reputation, a score of how trustworthy a given internet address is, collapses the moment an attacker rents a residential proxy for a few dollars. Geolocation, the check that says "this login came from Germany", is undone by a VPN.
AI makes the human side worse. A convincing voice clone of a chief executive now costs pennies. Fake login pages can be generated in seconds. The economics have tipped.
How does this fit with Zero Trust?
Zero Trust is a security approach that assumes nothing inside or outside the network should be trusted automatically. Every request has to prove itself. For years, that mostly meant tighter identity checks on the user. Device trust adds the second half: proving the hardware is legitimate too.
The model has been pushed hard by the US Cybersecurity and Infrastructure Security Agency in its Zero Trust Maturity Model, which lists devices as one of five core pillars alongside identity, networks, applications and data.
What does this mean for ordinary staff?
Expect more logins to be refused, even when you type everything correctly. If you try to reach work email from a personal laptop, a hotel PC or a phone that has not been enrolled with the company's device-management software, you may be turned away.
That is not a bug. It is the point. The trade-off is fewer stolen-password incidents and, hopefully, fewer 3am calls from the security team.
Should smaller companies care?
Yes, and this is the shift worth watching. Device trust used to be the preserve of banks and defence contractors. Cloud identity providers like Microsoft, Okta and Google now bundle device-check features into standard business plans, which puts the control within reach of a dentist's office or a mid-sized law firm.
The hard part is not the technology. It is the inventory: knowing which devices your staff actually use, and being willing to say no to the rest.
