A stolen password should not be enough to unlock a business account. That principle sits at the heart of multi-factor authentication (MFA), which asks users to prove their identity with more than one type of authentication factor before granting access.
For businesses, MFA can dramatically improve resistance to password theft, credential reuse and many automated account takeover attempts. An attacker who discovers an employee’s password still needs another factor before they can sign in.
However, MFA does not make an identity impossible to compromise. Attackers can target weaker authentication methods, manipulate users into approving requests, steal authenticated sessions or exploit poorly protected recovery processes. Some MFA methods also resist phishing much more effectively than others.
The current NIST authentication and authenticator management guidance reflects this distinction by separating authentication assurance from phishing resistance. Businesses therefore need to ask not only whether MFA is enabled, but also which MFA method protects each account and what happens after authentication succeeds.
What Does Multi-Factor Authentication Actually Protect Against?
Authentication factors generally rely on different forms of evidence, such as something the user knows, something they possess or a characteristic associated with the user. MFA combines factors so that compromise of one does not automatically provide account access.
A password paired with a second factor illustrates the basic model. If attackers obtain the password through phishing or a credential leak, they still need the additional authenticator before the service accepts the login.
That extra barrier makes MFA particularly valuable against password reuse. Attackers often test credentials exposed through unrelated data breaches against business services. MFA can stop many of those attempts even when the password itself remains valid.
It also reduces the effectiveness of password guessing and other automated credential attacks. Instead of relying entirely on the secrecy of one reusable password, the account requires another form of proof.
Businesses should therefore prioritise MFA for services where account takeover could create meaningful consequences. Email, remote access, cloud platforms, financial applications and administrative interfaces usually deserve particular attention.
The NCSC guidance for corporate online services recommends requiring MFA for users and administrators who access sensitive information and choosing authentication methods according to the sensitivity of the service.
MFA works most effectively as part of broader identity security for user accounts. Authentication helps control entry, while access rights, device security and monitoring determine what happens if someone still manages to compromise the account.
Where Multi-Factor Authentication Can Still Fail
The phrase “MFA enabled” can create more confidence than the actual authentication method deserves. Attackers do not need to defeat the underlying cryptography if they can convince a user to provide a valid code, approve a fraudulent request or hand over an already authenticated session.
Understanding these failure modes helps businesses decide where standard MFA provides enough protection and where stronger methods make sense.
MFA provides an important extra layer of protection, but not every method resists the same attacks. The infographic below shows the main failure points and how stronger authentication options reduce those risks.
1. Phishing Can Capture One-Time Authentication Codes
A one-time password creates an additional barrier, but the user can still type that code into a fraudulent website.
An attacker may create a convincing copy of a legitimate login page and relay the employee’s credentials to the genuine service. When the real service requests an MFA code, the fake site asks the victim for the same information and passes it onward before the code expires.
The user completed MFA, but they authenticated the attacker’s session rather than their intended session.
This limitation explains why NIST’s phishing-resistance requirements do not treat manually entered OTP authentication as phishing-resistant. A user can unknowingly provide the valid authenticator output to an impostor service.
MFA therefore remains useful even when it relies on one-time codes, but organisations should not confuse additional authentication with phishing-resistant authentication.
2. Push Notifications Can Create Approval Fatigue
Push-based authentication asks a user to approve or reject a login request through another device or application. This approach removes the need to type a code, but poorly designed implementations can create another social-engineering opportunity.
Suppose attackers already possess an employee’s password. They repeatedly attempt to sign in, causing the employee’s phone to display unexpected authentication prompts.
Most users will reject those requests. However, repeated prompts can create confusion, and an attacker may combine them with a convincing phone call or message claiming that IT needs the employee to approve a request.
The security problem comes from relying too heavily on the user’s interpretation of the prompt.
Businesses that use push-based MFA should configure the strongest protections their platform supports and educate users to reject authentication requests they did not initiate. Higher-risk identities should move towards methods that technically resist phishing rather than relying mainly on user judgement.
3. Attackers Can Target Account and MFA Recovery
Strong authentication can lose much of its value if attackers find an easier path through account recovery.
An organisation may carefully protect daily logins while allowing helpdesk staff to reset MFA after answering a few easily obtained questions. Attackers can exploit that discrepancy through social engineering.
They may impersonate an employee, claim to have lost their phone and request registration of a new authenticator. If the support process cannot reliably establish the caller’s identity, the attacker can bypass the existing MFA method without defeating it.
Security teams should therefore review password resets, authenticator replacement and emergency-access procedures alongside normal login controls.
NIST SP 800-63B-4 treats authenticator management as part of the authentication lifecycle, which reinforces the need to protect enrolment, replacement and recovery rather than focusing solely on the moment of login.
4. Session Theft Can Move the Attack Beyond MFA
MFA normally protects the process of establishing an authenticated session. Once the service creates that session, users can continue working without completing MFA for every individual action.
Attackers can target the session itself.
Malware on an employee endpoint may attempt to steal browser data, authentication tokens or other session material. In some attack scenarios, adversaries can also proxy a live authentication flow and capture session information after the victim successfully completes MFA.
The attacker then tries to operate through the authenticated session instead of performing another conventional login.
This is why strong MFA cannot compensate for a compromised endpoint. Businesses need endpoint hardening, monitoring and session controls alongside authentication.
The relationship becomes particularly important when deciding why identity and endpoint security must work together. The identity platform protects authentication, while the endpoint helps protect the environment in which authenticated access takes place.
5. MFA Does Not Correct Excessive Account Privileges
MFA determines whether the service should accept the authentication attempt. It does not decide whether the account has appropriate permissions after login.
A strongly protected user can still possess unnecessary access to sensitive applications, administrator functions or old project resources.
If attackers eventually compromise that identity, they inherit those permissions.
Consider an employee who has excellent phishing-resistant authentication but still retains administrator access from a previous role. MFA lowers the likelihood of account takeover, yet excessive privilege increases the consequences if takeover occurs through session theft, recovery abuse or another route.
Businesses therefore need least privilege and regular access reviews alongside MFA. Strong authentication should protect an appropriately limited account, not provide stronger protection around excessive permissions.
Which MFA Methods Offer Stronger Protection?
Businesses often speak about MFA as though every second factor provides the same level of assurance. In practice, authentication methods differ significantly in how they resist phishing, interception, theft and social engineering.
1. FIDO2 and Phishing-Resistant Authentication
FIDO2-based authentication uses public-key cryptography and can bind authentication to the legitimate service. This property makes it significantly harder for a phishing site to relay an authentication response to another domain.
The NCSC’s recommended MFA methods describe FIDO2 credentials on trusted devices or physical security keys as strong options that provide phishing resistance alongside protection against guessing.
Passkeys and compatible security keys can use these underlying standards, although the implementation and account-recovery model still matter.
Organisations should consider phishing-resistant methods particularly seriously for administrators, privileged users and employees with access to high-value information.
2. Authenticator Apps and One-Time Passwords
Authenticator applications that generate time-based codes provide a meaningful improvement over password-only authentication.
They do not depend on mobile network delivery and can prevent attackers from using a stolen password alone. However, users can still enter those codes into phishing pages.
NIST specifically notes that manual entry of OTP outputs does not meet its definition of phishing-resistant authentication because attackers can relay them during a fraudulent login flow.
That does not make authenticator apps ineffective. They can provide a practical level of additional security where stronger methods are not available, but organisations should understand the remaining attack path.
3. SMS and Message-Based Authentication
SMS codes also add protection compared with passwords alone, particularly when the alternative involves no second factor.
However, message-based authentication introduces additional weaknesses, including interception and attacks against the communication channel or account recovery process.
The NCSC recommends using message-based MFA mainly when stronger options are not practical. Organisations should therefore avoid treating SMS as the target state for high-risk administrative access when platforms support stronger alternatives.
Legacy systems sometimes leave businesses with limited choices. In those situations, SMS MFA may still offer more protection than password-only authentication while the organisation works towards stronger controls.
4. Biometrics Usually Protect an Authenticator Rather Than Replace Identity Security
Biometrics can improve both security and usability, but businesses need to understand where they fit.
A fingerprint or facial scan may unlock a device or authorise the use of a cryptographic credential stored on that device. The biometric check therefore works as part of the authentication process rather than acting as a reusable password sent to the online service.
For example, a passkey may require the employee to confirm their identity locally through a fingerprint, face recognition or PIN before the device uses the cryptographic credential.
Security teams should therefore assess the complete authentication system rather than asking whether it “uses biometrics”.
Comparing Common MFA Methods for Business Accounts
The right authentication method depends on the account, available technology and consequences of compromise. Businesses do not necessarily need the strongest method for every low-risk application, but they should understand the trade-offs.
|
MFA Method |
Main Advantage |
Important Limitation |
Typical Business Use |
| FIDO2 security key | Strong phishing resistance | Requires compatible services and key management | Privileged and high-risk users |
| Device-based passkey | Strong authentication with good usability | Recovery and device ecosystem need consideration | Workforce and cloud application access |
| Authenticator push | Convenient for users | Social engineering and approval abuse can remain possible | General workforce access |
| Authenticator OTP | Widely supported and stronger than passwords alone | Codes can be phished or relayed | Services without phishing-resistant options |
| Hardware OTP token | Works where phones may not be suitable | Manually entered codes remain phishable | Specific operational environments |
| SMS code | Easy to deploy and widely supported | Weaker than phishing-resistant alternatives | Legacy or transitional use |
Businesses should avoid choosing MFA purely according to convenience or licensing availability. Account sensitivity should influence the decision.
A privileged cloud administrator warrants stronger authentication than an employee accessing a low-impact internal application. This risk-based approach allows businesses to improve authentication where it matters most without creating unnecessary complexity everywhere.
MFA Needs Strong Endpoint and Access Controls After Login
Authentication represents one stage of the access process. Security still matters after the user passes it.
An endpoint can expose an authenticated session if malware controls the device. Excessive privileges can increase the damage caused by a compromised identity, while poor monitoring can allow suspicious access to continue unnoticed.
Device condition should therefore influence sensitive access where practical. A user may successfully complete MFA but still face restrictions if they connect from an unmanaged or high-risk endpoint.
This idea also supports Zero Trust endpoint security, where the organisation considers the user, endpoint and requested resource together rather than giving permanent trust after one successful authentication event.
Privileged accounts deserve even stronger protection. Administrators should avoid routine use of powerful identities, reduce standing privileges where practical and use appropriately secured endpoints for high-impact activities.
Aegixis Identity & Endpoint Security Services can help businesses evaluate authentication alongside access rights, privileged accounts, endpoint hardening and endpoint protection rather than treating MFA as an isolated security project.
How Businesses Can Strengthen MFA Without Creating Unnecessary Friction
A successful MFA programme needs both security and usability. If authentication creates excessive friction, users may seek workarounds, support teams may grant unsafe exceptions and administrators may hesitate to expand coverage.
Businesses should begin by identifying the accounts and applications where compromise would create the greatest impact. Privileged identities, email, cloud administration, remote access and sensitive business applications usually deserve early attention.
Authentication methods can then reflect the risk of those accounts. Phishing-resistant authentication may become the standard for administrators and high-risk users, while other accounts move progressively towards stronger methods as platforms and operational processes allow.
Recovery also requires deliberate design. Users will lose devices, replace phones and forget credentials. The business needs a secure way to restore access without making the recovery path significantly weaker than normal authentication.
Security teams should also review exceptions regularly. Service limitations, legacy applications and temporary operational needs can create accounts that bypass normal MFA policies. Those gaps should have documented owners and remediation plans rather than becoming permanent blind spots.
Finally, businesses need to monitor authentication activity. Unexpected MFA registrations, repeated failed challenges, recovery events and suspicious access patterns can reveal attacks even when the organisation already uses strong authentication.
A broader identity and endpoint security posture assessment can help identify inconsistent MFA coverage, privileged-account weaknesses, unmanaged devices and other gaps that weaken the overall access model.
Final Thoughts
MFA remains one of the most valuable controls businesses can place between stolen credentials and successful account takeover. Its effectiveness, however, depends heavily on the authentication method, the recovery process and the controls surrounding the authenticated session.
The strongest approach treats MFA as one layer rather than the finish line. Phishing-resistant authentication can remove important attack techniques, while least privilege, trusted endpoints and effective monitoring reduce the options attackers have if they find another route around the login process.
