Thales Workforce Identity and Access Management

SafeNet Trusted Access is the cloud-based access management platform at the center of Thales's Workforce IAM line - it handles single sign-on, multi-factor authentication, and risk-based access policies from one console, so every login goes through the same policy engine instead of a different flow for each system.

It supports adaptive authentication that adjusts requirements to context - location, device, and risk level - so low-risk logins stay frictionless while high-risk ones step up automatically, rather than applying the same fixed MFA prompt to every login regardless of actual risk.

Hardware USB tokens (the eToken 5300 and Fusion series) that hold a private key on a FIPS 140-2 certified chip, requiring physical possession plus a PIN to authenticate - a phishing site or malware on the machine has no key to steal, because the key never leaves the token.

Best suited for privileged accounts, administrators, and regulated environments where a software-only authenticator is not considered strong enough assurance.

PKI smart cards (IDPrime 940/3940, IDPrime PIV) that combine physical building access, Windows login, and digital signing on one card - a minidriver-enabled card works natively with Windows without extra client software, and the PIV variant meets FIPS 201 for federal, state, and local government use.

Where a USB token is one more thing to carry, a smart card usually replaces a badge an employee already carries every day.

FIDO2/WebAuthn security keys built for the authentication method CISA calls the gold standard for phishing resistance - the device signs a cryptographic challenge tied to the real website's origin, so a convincing phishing replica simply cannot get a valid response out of it, unlike a password or an OTP code a user can be tricked into typing into a fake login page.

Supports passwordless login directly, or as a second factor alongside a password, across Windows, macOS, and any FIDO2-compliant application or cloud service.

A software authenticator app for organizations that want strong MFA without issuing physical hardware to every employee - one-tap push approval, OTP generation, and QR-code enrollment from a phone already in every employee's pocket.

It is the practical middle ground between a plain SMS code (which CISA specifically flags as vulnerable to SIM swap and interception) and a hardware token: still software-based, but with number-matching push approval that resists the push-bombing attacks a bare approve/deny prompt is vulnerable to.