Spear Innovations Oy Ltd

24/09/2026

Passkeys are incredible for security, but terrible for user friction. Don't let Microsoft's automated prompts ruin your Thursday morning.

You should be able to take control of your MFA migration on your own terms before the 2027 deadline.

Power users often point out that a complex password [stored in a vault + a code generator app] provides strong security. However, traditional multi-factor authentication is not automatically phishing-resistant.

10/09/2026

20/08/2026

"In the beginning, there was only the username and password."
That's all we needed for access, until everyone realized it wasn't the strongest system.

In the early 2000s, SMS authentication was introduced to strengthen security and it quickly became the new standard. However as years passed cybercrime evolved accordingly and nowadays phishing combined with man-in-the-middle attacks have made them obselete (and authenticators share the same issues).

On February 1st, 2027, Microsoft is officially retiring SMS and phone call logins. So what comes next? Check out our latest blog to see how to prepare for the next steps.

(suomeksi alla) Microsoft is taking an important step towards phishing-resistant strong authentication. Passkeys are becoming the default authentication option in Microsoft Entra ID, while Microsoft-provided SMS and voice-based MFA will be retired by 1 February 2027. The change affects all Entra I

09/07/2026

Microsoft started rolling out synced passkeys in Entra ID.
This changes where employee credentials live, and the change was not a decision made by their organization, but rather the "default"
Passkeys come in two forms.
Synced passkeys are copied through a personal cloud account to every device signed into it.
Device-bound passkeys are stored on one piece of hardware and cannot be exported.
They have the same cryptography, but the custody is not.
For personal accounts, synced is usually the right choice. For workplace sign-ins, the question deserves more scrutiny than a default setting.

We explain the difference, and why it matters now, in our latest article.

If you have signed into Google, Microsoft, or your bank recently, you have probably been nudged to create a passkey. Maybe you did, with a fingerprint or a face scan, and it felt almost suspiciously easy. So what did you actually create?

22/06/2026

SuomiAreena, here we come! 📣

We couldn't be more excited to get invited to Pori's Defense Day tomorrow 🚀🔒

This will be a major gathering of Finland's security and defense innovators, and we will be on site showcasing our strong authentication solutions.

If you're in security, defense, or interested in cybersecurity solutions for individuals and organizations, find us at our booth (10:00–18:00)

Let's talk about trust, privacy, and innovation 💫
See you there!

Päätapahtumamme, Suomen suurin yhteiskunnallinen festivaali SuomiAreena, järjestetään Porissa 23.–26.6., kesäkuun viimeisellä viikolla. Festivaaliohjelman teemat syntyvät yli 200 eri organisaation…

18/06/2026

You've heard of the "Man-in-the-Middle", now meet the CSRF (Cross-Site Request Forgery). This one is an even more elaborate and more hidden attack.

It tricks your own browser into performing actions (like wire transfers or data deletions) while you’re logged in, often without you ever clicking a button on the target site.

You can learn more on how to counter this on here ⤵️

(suomeksi alla) A Cross-Site Request Forgery attack exploits a web application’s trust in the user’s browser. This allows the attacker to execute malicious code in the web application via the victim’s browser without the victim noticing. Let’s look at an example of how a CSRF attack works in...

26/02/2026

Recently, Traficom warned about a major blind spot in traditional security: Adversary-in-the-Middle (AitM) attacks. 🚩

These malicious hacks can intercept your login in real-time, bypassing SMS and app-based codes entirely.

In this blog post, we go beyond the warning: we have a "phishing-resistant" solution. Our physical keys keep your Microsoft, Google, Meta, and other accounts truly secure.

Iltalehti uutisoi äskettäin Traficomin antamasta varoituksesta, miten rikolliset ovat keksineet keinon ohittaa vahva tunnistautuminen Microsoft 365 -palveluissa ( https://www.iltalehti.fi/digiuutiset/a/ff3a7078-ef4b-4ee4-9e10-396d2b31cb7d ). Varoitus on erittäin aiheellinen ja se ansaitsee enemm....

13/02/2026

At Spear, we’ve long warned against relying on human judgment for authencation. It is too risky and it shifts the responsibility of the cybercrime onto the victim rather than the criminal or the authentication system.

20/02/2025

Social engineering has always been one step ahead of the security trainings..
😶‍🌫️ 🔒
With most organizations, there’s always a combination of a [wrong email + right employee (victim)] that would bring a whole system to a halt.
Why? ✨
Because in a way, cybersecurity trainings use the leftovers of previous data breaches, while hackers are working on the next technique 🫠🔓

We do however offer a mini quiz about a few tricks that scammers use 👀 https://form.jotform.com/242895129927067

Evaluate your own cybersecurity instincts, and you would realise why relying solely on employees for security is a risky bet.

06/02/2025

Mobile Wallet ✨CREDENTIALS✨ are Here!

Big changes ahead in the EU digital identity landscape.
By the end of 2026, your phone will carry ID credentials with the same legal standing as physical cards. Even better - you'll control exactly what personal data you share.
We're excited to announce that SpearID mobile wallet app is joining this revolution this spring, offering enterprise-grade verifiable credentials that work seamlessly with Microsoft Entra ID.
Key benefits:
Instant issuance and revocation
True passwordless authentication
Phishing-resistant security
Zero physical logistics costs
Want to see how this can transform your organization's identity management? Let's talk.
hashtag hashtag hashtag hashtag hashtag