Real customers. Real outcomes.

Aenova Group, a leading global contract manufacturer and development service provider for the pharmaceutical and healthcare industries, has strengthened its security posture with IDEE's AuthN passwordless same-device MFA solution.

In an industry where a single breach can result in contaminated drugs, regulatory sanctions, billions in losses, and even risks to patient lives, Aenova required enterprise-grade protection that was practical for its global workforce — nearly 5,000 users who rely primarily on their PCs without company-issued smartphones or hardware tokens for MFA.

Aenova had suffered multiple phishing attempts targeting Microsoft 365 credentials. With cyber insurance requirements tightening, NIS2 designating the healthcare and pharmaceutical sectors as critical infrastructure requiring robust cybersecurity measures, and the pharmaceutical sector facing heightened attacks, deploying strong MFA across its nearly 5,000 users became urgent.

Traditional MFA solutions were ruled out because they demanded second devices (phones, USB keys, or cards) — impractical for a global organization where most employees work exclusively on PCs. Moreover, typical deployments require extensive time, dedicated security staff, and significant change management — resources Aenova did not want to expend.

Although Aenova already had Conditional Access enabled and Microsoft Authenticator included in its Microsoft 365 licensing tier, these native capabilities fell short of the organization's security requirements for three key reasons:

• Phishing resistant vs. phishing proof: Microsoft Authenticator provides phishing resistance, but not true phishing-proof protection — a critical distinction when safeguarding high-stakes pharmaceutical operations and intellectual property.
• Second device requirement: Setting up a new device or registering for the 1^st time on M365 requires a second device, which is not practical given not all employees have a company device and not all employees are willing to use their private devices for work.
• BYOD limitations: With widespread Bring Your Own Device (BYOD) usage, phishable factors such as push notifications and one-time passwords (OTPs) can not be fully eliminated, leaving phishing attacks a daily risk.

Ease of deployment was a key deciding factor. After evaluating several MFA solutions, Aenova selected AuthN by IDEE for its true phishing-proof protection and native support for shared kiosk environments without requiring additional hardware or personal devices.

The solution did not require additional software installation or changes to Aenova's existing IT infrastructure, and it does not store personally identifiable information (PII).

The rollout to nearly 5,000 users was completed within a short timeframe, with relatively low effort from IT and minimal training required. Users authenticate by unlocking their device.

Six Week Deployment Across All Knowledge Workers

3 WEEKS

All knowledge workers were asked to register their devices.

15 MINUTES

It took just 15 minutes to federate (integrate) the various domains.

SECONDS

It took just a few seconds for each user to register their device(s).

3 WEEKS

Monitoring to ensure all use cases were covered with active support from IDEE.

Aenova's manufacturing and production environments rely heavily on shared kiosk PCs and shift-based workstations. Supporting these scenarios securely was a key requirement. AuthN by IDEE enables secure authentication on shared devices without requiring users to carry a second device such as a smartphone or hardware token. This allows every login—whether on a personal PC or shared workstation—to be protected while maintaining operational efficiency for factory floor staff and rotating shifts.

AuthN by IDEE turns any device into a phishing-resistant authenticator using the device's TPM chip and biometrics/PIN.

AuthN by IDEE provides a streamlined authentication experience while removing reliance on passwords. By leveraging device-based security, it helps protect against common attack vectors such as credential phishing, password spraying, and business email compromise.

Users authenticate simply by unlocking their device — no codes, no apps, no friction.

How it works.

User unlocks their device to register for the first time.

Device's cryptographic private key is bound to the user identity & web app/app.

1. Register any device once
(in just a few seconds).

Device is now an authenticator.

2. User unlocks device to
login with MFA.

Deployed May 1, 2023 — Now entering its fourth year with a new 5-year renewal signed in 2026.

Since going live in May 2023, Aenova has not experienced a successful password-based, credential phishing, or MFA bypass attack affecting its Microsoft 365 environment.

• Eliminated BEC & Phishing Risk: No successful password-based, credential phishing, or MFA bypass attacks on M365 infrastructure have been recorded since deployment.
• Manufacturing Kiosk Support: Extended full phishing-proof MFA protection to more than 100 shared production kiosks and multi-user devices protecting more than 1,000 shift-based and temporary workers without requiring personal hardware tokens or creating security workarounds.
• Frictionless Adoption: Users quickly adapted to the experience - authenticating by unlocking their device (personal or shared kiosk) to login.
• Operational Efficiency: 70%+ reduction in password/MFA-related helpdesk tickets since deployment (per internal IT metrics), eliminated hardware token logistics, and freed IT teams to focus on strategic projects and patch management.
• Regulatory & Insurance Compliance: Met and exceeded cyber insurance MFA mandates while supporting strict pharmaceutical industry security and data protection requirements for NIS2, KRITIS requirements (BSI), GDPR, and DORA. It delivers phishing-proof authentication that aligns with BSI recommendations for critical infrastructure operators and exceeds traditional MFA approaches still accepted under many existing frameworks.

Aenova Group has proven that enterprise-grade, phishing-proof security doesn't have to come at the cost of operational complexity. By deploying AuthN by IDEE, they protected nearly 5,000 users — including over 1,000 shift workers on shared kiosks — achieving zero successful attacks over three years, a significant reduction in helpdesk burden, and full regulatory alignment under NIS2 and KRITIS. The result is a scalable, user-friendly MFA solution that earned a five-year renewal and is now setting a new standard for secure authentication in pharmaceutical manufacturing.

About the Customer

DekaBank is one of Germany's largest securities institutions and the central asset manager of the Sparkassen-Finanzgruppe — the savings-bank network that is the largest financial association in Europe. It serves roughly 340 Sparkassen partner banks, whose group employs more than 280,000 people, and manages around €452 billion in assets for those banks and their customers.

To open new business for itself and the Sparkassen it serves, DekaBank built Deka Easy Access — a digital product that lets institutional users transact online, on the web and in-app. The users of that platform are the employees of DekaBank and of the Sparkassen it serves, which made the security and privacy of their digital identities the defining requirement of the entire project.

The Challenge

High-value institutional transactions and strict financial-services regulation meant DekaBank could accept no weak link in identity. Passwords and app- or token-based MFA carry well-documented vulnerabilities, and every conventional alternative introduced the same fundamental problem: a central credential database is a target, and a party you have to trust.

Any solution storing credentials centrally could neither guarantee the privacy of end users nor rule out insider threats — whether at DekaBank or at a vendor. For a platform authenticating institutional and, later, cryptocurrency transactions, that residual trust was itself an unacceptable risk. DekaBank did not need a faster way to deploy authentication. It needed authentication that removed trust from the equation entirely.

Why DekaBank Chose IDEE The Solution The Partnership