Between 1 and 29 August 2026 the word phishing occurred in 1,388 podcast episodes from 889 shows, in a Particle podcast index of about 87,000 episodes, and the word passwordless occurred in 29 episodes from 28 shows over the same dates (Particle podcast index, August 2026). That is 48 times as many episodes for phishing as for passwordless, 1,388 divided by 29 being 47.9 (CTC calculation from Particle podcast index, August 2026).
That count, for an IT director, is the wrong way round. We say so because a phishing email comes in two cases with two different fixes, and only one of those fixes had a word in the 29 episodes (Particle podcast index, August 2026). Case one is an invoice to the accounts inbox under a supplier's name, asking for the next payment to go to a new bank account, and no sign-in technology stops it. CTC's guide of 18 December 2025 to phishing and email scams and how to spot them sets out the signs to check (Compare the Cloud, 18 December 2025). Case two is a link to a page that copies the company sign-in screen, and a passkey defeats that page because it is bound to the real domain, so a lookalike receives no credential. Passwordless is the word for that. Podcasts said it in 29 episodes in August 2026 (Particle podcast index, August 2026).
What is the meaning of phishing?
Phishing is a message by email, text or phone call that pretends to come from someone the recipient trusts, so that they hand over a password, approve a payment or open a file. In August 2026 the word occurred in 1,388 podcast episodes (Particle podcast index, August 2026).
It describes a method, not a technology. The attacker breaks nothing, because the recipient does the work of typing the password or paying the invoice, which is why CTC's guide of 18 December 2025 is written for that person at the inbox (Compare the Cloud, 18 December 2025).
How often do podcasts talk about phishing?
Podcasts said phishing in 1,388 episodes from 889 distinct shows between 1 and 29 August 2026, in a Particle podcast index of about 87,000 episodes for that window (Particle podcast index, August 2026). Over the same dates, in the same index, passwordless was said in 29 episodes from 28 shows (Particle podcast index, August 2026).
Those 1,388 episodes came from 889 shows, so the average show that said phishing said it in fewer than two episodes that month (CTC calculation from Particle podcast index, August 2026). Both counts are for the exact phrase, so an episode that said passkey or FIDO2 without saying passwordless is not among the 29, and what we are comparing is two words (Particle podcast index, August 2026).
Podcast episodes naming each phrase, 1 to 29 August 2026
Podcast episodes naming each phrase, 1 to 29 August 2026
View the data
| Category | Count |
|---|---|
| phishing | 1,388 |
| passwordless | 29 |
Which four types of phishing are there?
The four types of phishing are bulk email phishing sent to many addresses, spear phishing written for one named person, whaling aimed at a director or finance signatory, and smishing or vishing by text message and phone call. All four sit under the single word that 1,388 podcast episodes used in August 2026 (Particle podcast index, August 2026).
They differ in effort and target. Bulk phishing needs a small fraction of many recipients to respond, spear phishing and whaling research one person and write for whoever can authorise a payment or a password reset, and smishing and vishing move the same request to a text or a call, where there is no header to inspect. In each of the four, though, the attacker wants a credential or an approval typed by a person, which is why the two phishing suppliers in the CTC Directory in September 2026, Phishing Tackle and RedFlags, are listed for simulated phishing and staff training (CTC Directory, September 2026).
How does a phishing attack look in practice?
CTC's working example of a phishing attack for IT directors in September 2026 is an email to the accounts inbox under a supplier's name, saying the bank details have changed and asking for the next invoice to go to the new account, with a sender address one character off the real one.
It asks a person to do a normal job slightly differently, and that is why it carries neither attachment nor link nor malware. There is one defence. Someone checks by another channel before doing it, which CTC's guide to phishing training for staff turns into a habit (Compare the Cloud, 19 December 2025).
Example two is the login page: an email says a document is waiting, the link opens a copy of the company sign-in screen, and the user types their password into it. This is the case passwordless authentication was designed for, and the one a security podcast could pair with the word phishing. In August 2026 the word appeared in 29 episodes (Particle podcast index, August 2026).
How does going passwordless work?
Going passwordless means signing in with a credential that is never typed, such as a passkey held on the phone or laptop, a security key, or the device's fingerprint or face unlock. Nothing is typed, so a phishing page has nothing to capture. Podcasts named the approach in 29 episodes in August 2026 (Particle podcast index, August 2026).
The device proves it holds the right key for the right site, and the user proves presence with a fingerprint, a face or a PIN that stays on the device, so no shared secret crosses the network and none can be stolen or reused. For an IT director the work in 2026, as we see it, is an inventory. Which of the firm's applications accept a passkey or a security key, and which still demand a password?
Is it safer to go passwordless?
Against the phishing sign-in page, yes. A passkey is bound to the domain that registered it, so a lookalike site receives no credential and a fake login page has nothing to reuse. The payment request is the other case, and CTC's staff training guide of 19 December 2025 covers it (Compare the Cloud, 19 December 2025).
A password is a secret the user knows and can be persuaded to reveal, whereas a passkey is a secret the device holds and the user cannot recite, so persuasion has nothing to work on. The invoice redirect above is a payment request, and passwordless doesn't solve it. The fake sign-in page it solves outright. For the first case, CTC's guide of 18 December 2025 is the reference (Compare the Cloud, 18 December 2025).
Which disadvantages does passwordless authentication carry?
Passwordless authentication, said in 29 podcast episodes in August 2026, carries four disadvantages (Particle podcast index, August 2026). A lost or broken device locks the user out until recovery is done, older applications still demand a password, hardware keys cost money per person, and the recovery path becomes the new phishing target. Each is a design task.
Recovery is the largest of the four, because if a user who loses their phone can regain access by answering an email, the email has become the credential and the phishing exposure has moved. It has to be as strong as the login it replaces, which means a second registered device or a spare hardware key held somewhere safe. For credentials that are already exposed, the CTC Directory lists Digital Shadows for monitoring (CTC Directory, September 2026).
Legacy applications are the second constraint, because an application that accepts only a username and password keeps that password in circulation, and every password in circulation is a phishing target. The task for 2026 is to list those applications, date each one's replacement, and put a password manager and a multi-factor prompt in front of them until then.
Method and definitions
Particle's podcast index for 1 to 29 August 2026 supplied the podcast figures, and it held about 87,000 episodes for that window (Particle podcast index, August 2026). An episode counts once if the exact phrase occurred in it, and a show once if any of its episodes matched, so an episode saying passkey or FIDO2 without the word passwordless is not counted (Particle podcast index, August 2026). The index is a sample of podcasts and is not limited to UK shows. It describes reach within itself for one month, so the figures carry no trend, and we hold no figure for July 2026 (Particle podcast index, August 2026). CTC derived two figures from the index's counts: the ratio of 47.9 to 1 from 1,388 and 29, and the average of fewer than two episodes per show from 1,388 and 889 (CTC calculation from Particle podcast index, August 2026). Directory listings are those present on comparethecloud.net/directory in September 2026 (CTC Directory, September 2026). We compiled the page on 26 September 2026.
For an IT director the two cases give the week's work, dated 26 September 2026. The invoice email is answered by a check over a second channel before any bank detail changes, and the sign-in page by an inventory of which applications will take a passkey today. As for which of the two words the team is likelier to have heard, the count of 1,388 to 29 for August 2026 already says (Particle podcast index, August 2026).
Sources
- Particle podcast index, August 2026 (episodes and shows naming the exact phrases phishing and passwordless, 1 to 29 August 2026, about 87,000 episodes searched).
- CTC calculation from Particle podcast index, August 2026 (ratio of 47.9 to 1 from 1,388 and 29; average of fewer than two episodes per show from 1,388 and 889).
- Compare the Cloud, 18 December 2025, Help guide for phishing and email scams and how to spot them and what to do, https://www.comparethecloud.net/articles/phishing-email-scams-small-business-uk-2025
- CTC Directory, September 2026, Phishing Tackle, https://www.comparethecloud.net/directory/listing/phishing-tackle
- CTC Directory, September 2026, RedFlags, https://www.comparethecloud.net/directory/listing/redflags
- Compare the Cloud, 19 December 2025, Help guide for phishing training for staff, https://www.comparethecloud.net/articles/phishing-training-staff-small-business-uk-2025
- CTC Directory, September 2026, Digital Shadows, https://www.comparethecloud.net/directory/listing/digital-shadows
