What exactly is Deviceless MFA — and how is the Identity Challenge Card different from every other MFA?

Deviceless MFA is multi-factor authentication that works without a phone, an app, a hardware token, or a network connection. The Identity Challenge Card is the first production implementation: a printed grid of word pairs that a user looks up during login. When Stryker's device-bound MFA went down during the Iranian Handala intrusion, Deviceless MFA is the category that would have kept workforce verification running — one day to deploy, every worker covered, zero device dependency.

Is a printed card actually secure? A lost card means a compromised credential.

The card contains no personal data and no identity information. Without the PIN it is useless. A lost card is less dangerous than a lost phone — you can't SIM-swap paper. The card is revoked in seconds and replaced the same day. Cyber attackers cannot compromise paper. That is an architectural truth, not a tagline.

We already have MFA. Why does our existing solution leave a documented gap?

Authentication that works for 20% of your workforce does not protect your organization — it creates a documented 80% vulnerability. Every MFA exception you've written is a gap an attacker can map. Device-dependent MFA assumes devices, networks, and identity systems are available. During the Stryker attack, none of those assumptions held. Deviceless MFA is how you stop documenting 80% exceptions and start documenting 100% coverage.

What happens during an active cyberattack when identity systems are down?

That is exactly what this was built for. Nothing runs at authentication time — no server call, no network dependency, no identity provider. The card resolves locally. When everything else fails, the card still works. Your service desk can still verify users. Business operations can continue. That's what Deviceless MFA is built to do.

Can push bombing or replay attacks work against this?

No. There are no push notifications — so push fatigue attacks have no surface. Each coordinate value is one-time — used values are permanently burned and never reused. Replay attacks are structurally impossible. Air-gapped Deviceless MFA means no network attack surface exists.

How does this meet CMMC, HIPAA, PCI-DSS, and GDPR requirements?

Every major compliance framework requires authentication that works for every worker in every environment. Device-dependent MFA cannot deliver that — your exceptions are documented compliance risk. A governed Identity Challenge Card closes every exemption with immutable audit logs, policy-enforced expiration, and identity-verified re-enrollment. No personal data is processed by the auth mechanism — zero GDPR exposure.

Does this replace our existing SSO and IdP, or sit alongside it?

It sits alongside your existing MFA — not instead of it. Policy routes each worker to the right method. Your desk workers keep push notifications. Your factory floor, field staff, and restricted-environment workers get the card. Both are governed. Both are covered. Zero rip-and-replace. Deviceless MFA sits alongside device-bound MFA and closes the workers it can't reach.

How do we actually deploy Deviceless MFA to 50,000 users?

A single IGA workflow bulk-provisions cards for every worker simultaneously. No hardware procurement cycle. No app install. No per-worker IT session. Workers receive a card — same delivery channel as an ID badge. On-site, mailed, or kiosk-printed on demand. Deployment takes one day.

How do I explain Deviceless MFA to the board without getting into authentication acronyms?

Boards don't ask which authentication product you use — they ask how long the business is exposed when identity fails. Deviceless MFA is the answer to that question. When device-bound MFA goes down, the Identity Challenge Card keeps every worker verified. It's the continuity story that turns a front-page headline into a footnote in the annual report.

What is my SEC 8-K disclosure story if identity systems fail during a breach?

Under the SEC's four-day cyber disclosure rule, identity failure is a material event. Deviceless MFA gives CEOs a defensible answer to the first question on every 8-K filing: what continuity plan did you have for when device-bound MFA failed? The Identity Challenge Card is that plan — in production, audited, and documented.

Is Deviceless MFA a real category or a rebrand of hardware tokens?

Hardware tokens are devices — they have batteries, firmware, serial numbers, and supply chains. Deviceless MFA has none of those. A printed grid of word pairs resolves challenges locally with no power, no network, no provisioning cycle. The architecture is fundamentally different from FIDO2 security keys, TOTP apps, and push-based authenticators — which is why incumbents cannot replicate it by shipping an update.

Deviceless MFA Comparison

See ComplianceTry It Book Live Demo

Back to Identity Challenge Card

Methodology & Sources

This page documents how the Fortune 500 device-dependency rankings were derived, including definitions, estimation methodology, and all cited sources.

Download PDF

Purpose

Rank 20 major Fortune 500 industries by device-based MFA reach — the share of workers who have a company-issued or personal device that can run an MFA authenticator. Industries with the lowest office/desk share (highest frontline share) appear first, because those are where traditional device-based MFA covers the smallest portion of the workforce.

Definitions

Field / Frontline Worker

Deskless employees whose primary work is on a store floor, plant floor, construction site, rig, field route, vehicle, patient room, classroom, or similar — and who typically do NOT have a dedicated company-issued computing device suitable for device-bound MFA.

Office / Desk Worker

Employees with a dedicated workstation (laptop or desktop) and typically a company email account and company-managed device — the population that device-based MFA can actually reach.

Device MFA Reach

Equal to the Office / Desk percentage. This is the ceiling for how much of the workforce can be protected by device-bound MFA without adopting alternate factors.

How the Percentages Were Derived

1. Industry list:Based on Fortune 500 industry categories (2025 list) and the Wikipedia “List of largest companies in the United States by revenue.” Industries were consolidated where Fortune uses multiple narrow codes.

2. Field vs. office splits: Research-backed estimates anchored to published studies of the deskless workforce from Emergence Capital, BCG, Gartner, Simpplr, WGU Labs, Quinyx, and Firstup.

3. Fortune 500 adjustment: Fortune 500 companies tend to have somewhat larger corporate HQ functions than the industry average, so office percentages are nudged upward 2–5 points from raw industry deskless ratios.

4. Special cases:Government/Military and K-12/Higher Ed are included as reference categories (not Fortune 500). Aerospace & Defense and Government/Military are device-restricted for security reasons (SCIFs, classified areas) rather than economic ones.

Confidence & Caveats

These percentages are estimates at the industry level, not audited company counts. Actual splits vary significantly within an industry (e.g., a pure-play e-commerce retailer is far more office-heavy than a grocery chain, yet both are “Retail”). For a production roadmap, validate per target account using LinkedIn Sales Navigator employee function filters, 10-K employee disclosures, or direct discovery calls.

Full Industry Data

#	Industry	Representative Companies	Field %	Office %	MFA Reach	Notes
1	Food Services & Restaurants	McDonald's, Starbucks, Yum Brands, Chipotle	95%	5%	5%	Store crews, line cooks, servers — no corporate device at shift level.
2	Hospitality & Lodging	Marriott, Hilton, Hyatt, MGM Resorts	93%	7%	5%	Housekeeping, front desk, F&B, maintenance — mostly shared terminals.
3	Specialty & General Retail	Walmart, Target, Home Depot, Lowe's, Kroger, Best Buy	92%	8%	7%	Store associates, cashiers, stockers. Build-A-Bear pattern (~90% field).
4	Construction & Engineering	Fluor, Jacobs, AECOM, Quanta Services	90%	10%	8%	Crews, site supervisors, equipment operators — shared iPads at best.
5	Agriculture & Food Production	Tyson Foods, Archer Daniels Midland, Cargill	90%	10%	10%	Plant-floor processors, farm workers, drivers.
6	Transportation & Logistics	UPS, FedEx, Union Pacific, C.H. Robinson, Ryder	88%	12%	10%	Drivers, warehouse, rail/port crews. Handhelds issued but not full MFA devices.
7	Oil, Gas & Energy Services	ExxonMobil, Chevron, ConocoPhillips, Halliburton, Schlumberger	85%	15%	12%	Rig, refinery, pipeline, field service techs. Intrinsically-safe device limits.
8	Manufacturing (Industrial & Heavy)	Caterpillar, Deere, 3M, Honeywell, GE, Stanley Black & Decker	85%	15%	15%	Plant-floor operators, maintenance, QA — clean-room/safety device restrictions.
9	Automotive Manufacturing	Ford, GM, Stellantis, Tesla	85%	15%	15%	UAW plant workers, body shop, paint, assembly — locker policies for phones.
10	Healthcare Delivery (Providers)	HCA, CVS Health, Walgreens, Kaiser, UnitedHealth (Optum)	82%	18%	15%	Nurses, techs, pharmacy, home health. Shared workstations + badge auth typical.
11	Utilities (Electric, Gas, Water)	Duke Energy, Southern Co., NextEra, Exelon, PG&E	80%	20%	18%	Lineworkers, meter readers, plant operators. Ruggedized but limited fleet.
12	Airlines & Air Transport	Delta, American, United, Southwest	78%	22%	20%	Pilots, FAs, ramp, gate, maintenance. EFBs issued but not universal MFA.
13	Aerospace & Defense	Lockheed Martin, Boeing, RTX, Northrop Grumman, General Dynamics	70%	30%	25%	Factory floor + classified areas restrict personal devices; CAC cards common.
14	Telecommunications	AT&T, Verizon, T-Mobile, Comcast, Charter	68%	32%	30%	Field techs, installers, call center agents, retail stores.
15	Pharmaceutical & Biotech	Johnson & Johnson, Pfizer, Merck, Eli Lilly, AbbVie	60%	40%	32%	Manufacturing + lab + large sales force; R&D and HQ heavily office-based.
16	Media & Entertainment	Disney, Warner Bros. Discovery, Comcast NBCU, Paramount	55%	45%	40%	Parks, studios, broadcast crews vs. corporate, creative, and IT.
17	Insurance	Berkshire, State Farm, Progressive, MetLife, Allstate, Liberty Mutual	25%	75%	45%	Mostly underwriters, claims, actuarial, customer service — device-equipped.
18	Legal & Professional Services	Deloitte, PwC, CBRE, Accenture	22%	78%	78%	Mostly knowledge workers; court staff, process servers, and contract workers at client sites create gaps.
19	Banking & Financial Services	JPMorgan, Goldman Sachs, Bank of America, Wells Fargo, Citi	18%	82%	82%	Mostly desk-based; branch tellers on shared terminals and third-party vendors pull coverage down.
20	Software & Cloud Technology	Microsoft, Salesforce, Google, Adobe, Oracle	15%	85%	88%	Highest MFA reach of any industry. Data center techs, facilities staff, and contractors still create a 12% gap.

Sources

1
Fortune
'2025 Fortune 500 List', June 2, 2025
https://fortunemedia.mediaroom.com/2025-06-02-Fortune-Announces-2025-Fortune-500-List
2
Wikipedia
'List of largest companies in the United States by revenue' (2025 edition)
https://en.wikipedia.org/wiki/List_of_largest_companies_in_the_United_States_by_revenue
3
Emergence Capital
'The State of Technology for Deskless Workers' (2020)
https://www.emcap.com/technology-for-the-deskless-workforce-2020
4
Boston Consulting Group
'Making Work Work Better for Deskless Workers', Dec 15, 2022
https://www.bcg.com/press/15december2022-deskless-workers-looking-for-new-jobs
5
Simpplr
'What Is a Deskless Worker?'
https://www.simpplr.com/glossary/deskless-worker/
6
WGU Labs
'Empowering Deskless Workers for Economic Mobility'
https://www.wgulabs.org/posts/empowering-the-deskless-workforce
7
Firstup
'Deskless Workers — Overcoming Challenges to Drive Productivity'
https://firstup.io/blog/deskless-workers/