What exactly is Deviceless MFA — and how is the Identity Challenge Card different from every other MFA?

Deviceless MFA is multi-factor authentication that works without a phone, an app, a hardware token, or a network connection. The Identity Challenge Card is the first production implementation: a printed grid of word pairs that a user looks up during login. When Stryker's device-bound MFA went down during the Iranian Handala intrusion, Deviceless MFA is the category that would have kept workforce verification running — one day to deploy, every worker covered, zero device dependency.

Is a printed card actually secure? A lost card means a compromised credential.

The card contains no personal data and no identity information. Without the PIN it is useless. A lost card is less dangerous than a lost phone — you can't SIM-swap paper. The card is revoked in seconds and replaced the same day. Cyber attackers cannot compromise paper. That is an architectural truth, not a tagline.

We already have MFA. Why does our existing solution leave a documented gap?

Authentication that works for 20% of your workforce does not protect your organization — it creates a documented 80% vulnerability. Every MFA exception you've written is a gap an attacker can map. Device-dependent MFA assumes devices, networks, and identity systems are available. During the Stryker attack, none of those assumptions held. Deviceless MFA is how you stop documenting 80% exceptions and start documenting 100% coverage.

What happens during an active cyberattack when identity systems are down?

That is exactly what this was built for. Nothing runs at authentication time — no server call, no network dependency, no identity provider. The card resolves locally. When everything else fails, the card still works. Your service desk can still verify users. Business operations can continue. That's what Deviceless MFA is built to do.

Can push bombing or replay attacks work against this?

No. There are no push notifications — so push fatigue attacks have no surface. Each coordinate value is one-time — used values are permanently burned and never reused. Replay attacks are structurally impossible. Air-gapped Deviceless MFA means no network attack surface exists.

How does this meet CMMC, HIPAA, PCI-DSS, and GDPR requirements?

Every major compliance framework requires authentication that works for every worker in every environment. Device-dependent MFA cannot deliver that — your exceptions are documented compliance risk. A governed Identity Challenge Card closes every exemption with immutable audit logs, policy-enforced expiration, and identity-verified re-enrollment. No personal data is processed by the auth mechanism — zero GDPR exposure.

Does this replace our existing SSO and IdP, or sit alongside it?

It sits alongside your existing MFA — not instead of it. Policy routes each worker to the right method. Your desk workers keep push notifications. Your factory floor, field staff, and restricted-environment workers get the card. Both are governed. Both are covered. Zero rip-and-replace. Deviceless MFA sits alongside device-bound MFA and closes the workers it can't reach.

How do we actually deploy Deviceless MFA to 50,000 users?

A single IGA workflow bulk-provisions cards for every worker simultaneously. No hardware procurement cycle. No app install. No per-worker IT session. Workers receive a card — same delivery channel as an ID badge. On-site, mailed, or kiosk-printed on demand. Deployment takes one day.

How do I explain Deviceless MFA to the board without getting into authentication acronyms?

Boards don't ask which authentication product you use — they ask how long the business is exposed when identity fails. Deviceless MFA is the answer to that question. When device-bound MFA goes down, the Identity Challenge Card keeps every worker verified. It's the continuity story that turns a front-page headline into a footnote in the annual report.

What is my SEC 8-K disclosure story if identity systems fail during a breach?

Under the SEC's four-day cyber disclosure rule, identity failure is a material event. Deviceless MFA gives CEOs a defensible answer to the first question on every 8-K filing: what continuity plan did you have for when device-bound MFA failed? The Identity Challenge Card is that plan — in production, audited, and documented.

Is Deviceless MFA a real category or a rebrand of hardware tokens?

Hardware tokens are devices — they have batteries, firmware, serial numbers, and supply chains. Deviceless MFA has none of those. A printed grid of word pairs resolves challenges locally with no power, no network, no provisioning cycle. The architecture is fundamentally different from FIDO2 security keys, TOTP apps, and push-based authenticators — which is why incumbents cannot replicate it by shipping an update.

Deviceless MFA Comparison

See Compliance Trust Center Try It Book Live Demo

Back to Identity Challenge Card

Methodology & Sources

This page documents how the large-enterprise device-dependency rankings were derived, including definitions, estimation methodology, and all cited sources.

Download PDF

Purpose

Rank 20 major large-enterprise industries by device-based MFA reach — the share of workers who have a company-issued or personal device that can run an MFA authenticator. Industries with the lowest office/desk share (highest frontline share) appear first, because those are where traditional device-based MFA covers the smallest portion of the workforce.

Definitions

Field / Frontline Worker

Deskless employees whose primary work is on a store floor, plant floor, construction site, rig, field route, vehicle, patient room, classroom, or similar — and who typically do NOT have a dedicated company-issued computing device suitable for device-bound MFA.

Office / Desk Worker

Employees with a dedicated workstation (laptop or desktop) and typically a company email account and company-managed device — the population that device-based MFA can actually reach.

Device MFA Reach

Equal to the Office / Desk percentage. This is the ceiling for how much of the workforce can be protected by device-bound MFA without adopting alternate factors.

How the Percentages Were Derived

1. Industry list: Based on large-enterprise industry categories (2025 revenue-ranked U.S. company lists) cross-referenced with public company databases. Industries were consolidated where sources use multiple narrow codes.

2. Field vs. office splits: Research-backed estimates anchored to published studies of the deskless workforce from enterprise venture capital research, global strategy consultancies, industry analyst firms, employee experience platforms, higher-education research labs, and workforce communications platforms.

3. Large-enterprise adjustment: Large-enterprise companies tend to have somewhat larger corporate HQ functions than the industry average, so office percentages are nudged upward 2–5 points from raw industry deskless ratios.

4. Special cases:Government/Military and K-12/Higher Ed are included as reference categories (not large-enterprise commercial). Aerospace & Defense and Government/Military are device-restricted for security reasons (SCIFs, classified areas) rather than economic ones.

Confidence & Caveats

These percentages are estimates at the industry level, not audited company counts. Actual splits vary significantly within an industry (e.g., a pure-play e-commerce retailer is far more office-heavy than a grocery chain, yet both are “Retail”). For a production roadmap, validate per target account using LinkedIn Sales Navigator employee function filters, 10-K employee disclosures, or direct discovery calls.

Full Industry Data

#	Industry	Representative Companies	Field %	Office %	MFA Reach	Notes
1	Food Services & Restaurants	Global QSR & casual-dining chains	95%	5%	5%	Store crews, line cooks, servers — no corporate device at shift level.
2	Hospitality & Lodging	International hotel groups & resorts	93%	7%	5%	Housekeeping, front desk, F&B, maintenance — mostly shared terminals.
3	Specialty & General Retail	Big-box, grocery, home-improvement & specialty retailers	92%	8%	7%	Store associates, cashiers, stockers. ~90% field pattern is typical.
4	Construction & Engineering	Global engineering & construction firms	90%	10%	8%	Crews, site supervisors, equipment operators — shared tablets at best.
5	Agriculture & Food Production	Major food processors & agribusiness	90%	10%	10%	Plant-floor processors, farm workers, drivers.
6	Transportation & Logistics	Parcel carriers, freight, rail & logistics operators	88%	12%	10%	Drivers, warehouse, rail/port crews. Handhelds issued but not full MFA devices.
7	Oil, Gas & Energy Services	Integrated oil majors & oilfield services	85%	15%	12%	Rig, refinery, pipeline, field service techs. Intrinsically-safe device limits.
8	Manufacturing (Industrial & Heavy)	Heavy-equipment & industrial conglomerates	85%	15%	15%	Plant-floor operators, maintenance, QA — clean-room/safety device restrictions.
9	Automotive Manufacturing	Global automakers & EV producers	85%	15%	15%	Plant workers, body shop, paint, assembly — locker policies for phones.
10	Healthcare Delivery (Providers)	Hospital systems, clinics & pharmacy chains	82%	18%	15%	Nurses, techs, pharmacy, home health. Shared workstations + badge auth typical.
11	Utilities (Electric, Gas, Water)	Investor-owned power & utility operators	80%	20%	18%	Lineworkers, meter readers, plant operators. Ruggedized but limited fleet.
12	Airlines & Air Transport	Legacy & low-cost passenger carriers	78%	22%	20%	Pilots, cabin crew, ramp, gate, maintenance. EFBs issued but not universal MFA.
13	Aerospace & Defense	Prime defense contractors & aircraft OEMs	70%	30%	25%	Factory floor + classified areas restrict personal devices; smart cards common.
14	Telecommunications	National wireless & broadband carriers	68%	32%	30%	Field techs, installers, call center agents, retail stores.
15	Pharmaceutical & Biotech	Global pharma manufacturers & biotechs	60%	40%	32%	Manufacturing + lab + large sales force; R&D and HQ heavily office-based.
16	Media & Entertainment	Studios, streamers & live entertainment	55%	45%	40%	Parks, studios, broadcast crews vs. corporate, creative, and IT.
17	Insurance	P&C, life & multi-line insurance carriers	25%	75%	45%	Mostly underwriters, claims, actuarial, customer service — device-equipped.
18	Legal & Professional Services	Big-four audit, consulting & advisory firms	22%	78%	78%	Mostly knowledge workers; court staff, process servers, and contract workers at client sites create gaps.
19	Banking & Financial Services	Money-center banks & investment firms	18%	82%	82%	Mostly desk-based; branch tellers on shared terminals and third-party vendors pull coverage down.
20	Software & Cloud Technology	Hyperscale cloud & enterprise SaaS	15%	85%	88%	Highest MFA reach of any industry. Data center techs, facilities staff, and contractors still create a 12% gap.

Sources

1
Business publication
2025 ranking of largest U.S. companies by revenue, June 2, 2025
2
Open reference database
'List of largest companies in the United States by revenue' (2025 edition)
3
Enterprise venture capital research
'The State of Technology for Deskless Workers' (2020)
4
Global strategy consultancy
'Making Work Work Better for Deskless Workers', Dec 15, 2022
5
Employee experience platform research
'What Is a Deskless Worker?'
6
Higher-education research lab
'Empowering Deskless Workers for Economic Mobility'
7
Workforce communications platform research
'Deskless Workers — Overcoming Challenges to Drive Productivity'