Why MFA Alone Isn’t Enough Anymore
Multi-factor authentication remains one of the most effective security controls available — but modern threats require more than simply enabling MFA.
Multi-factor authentication (MFA) is one of the highest-impact security measures an organization can implement. It has significantly reduced the success rate of many credential-based attacks and should be a foundational part of any identity security strategy.
However, MFA should not be viewed as the final step in protecting user accounts.
Attackers have adapted. Instead of only trying to steal passwords, they are increasingly targeting the processes, sessions, and user behaviors around authentication.
The goal is not to replace MFA — it is to strengthen it by addressing the ways attackers attempt to bypass or work around it.
Where MFA Falls Short
MFA Fatigue Attacks
One of the most common MFA bypass techniques involves abusing push notifications.
If an attacker already has a user’s password, they may repeatedly send login approval requests until the user accepts one — often due to frustration, confusion, or simply trying to make the notifications stop.
This attack does not require breaking security technology. It takes advantage of human behavior.
SIM Swapping
SMS-based MFA provides additional protection compared to using passwords alone, but it has known weaknesses.
In a SIM swap attack, an attacker convinces a mobile carrier to transfer a victim’s phone number to a new SIM card. Once successful, they may be able to receive authentication codes intended for the legitimate user.
For stronger protection, organizations should move away from SMS-based authentication where possible.
Session Token Theft
Modern attackers increasingly target authenticated sessions rather than authentication itself.
After a user successfully completes MFA, attackers may attempt to steal browser cookies or session tokens that allow continued access without requiring another login.
In these cases, MFA has worked — but the attacker is targeting what happens after authentication.
Legacy Authentication Protocols
Older authentication methods, such as legacy email protocols, may not support modern MFA protections.
If these protocols remain enabled, attackers may use them as an alternative path around MFA requirements.
Organizations should identify and disable legacy authentication methods unless there is a clear and documented business requirement.
What to Add Alongside MFA
Use Stronger, Phishing-Resistant Authentication
Not all MFA methods provide the same level of protection.
Organizations should consider stronger authentication methods, such as:
- Number matching instead of simple approve/deny prompts
- FIDO2 security keys
- Certificate-based authentication
These approaches make it significantly harder for attackers to trick users into approving fraudulent login attempts.
Implement Conditional Access Policies
Authentication decisions should consider context, not just credentials.
Conditional Access policies can require additional verification based on signals such as:
- Unusual login locations
- Unknown devices
- Impossible travel activity
- Risky sign-in behavior
This allows organizations to apply stronger controls when the situation requires them.
Disable Legacy Authentication
Legacy protocols that cannot support modern security controls should be disabled wherever possible.
Removing these outdated authentication paths eliminates common bypass opportunities and simplifies identity management.
Protect Sessions and Access Tokens
Authentication does not end after login.
Organizations should implement additional protections such as:
- Continuous access evaluation
- Appropriate session timeout settings
- Shorter token lifetimes for sensitive applications
- Additional monitoring for unusual session activity
These controls reduce the usefulness of stolen session information.
Strengthen Privileged Accounts
Administrative accounts represent some of the highest-value targets for attackers.
Privileged accounts should have:
- Stronger authentication requirements
- Additional monitoring
- Limited standing access
- Just-in-time access where possible
Reducing unnecessary administrative privileges limits the potential impact of account compromise.
Why This Matters
Identity has become one of the primary targets in modern cyber attacks. This does not mean MFA is ineffective — it means attackers have shifted their tactics.
Organizations that rely only on basic MFA may still leave important gaps in their identity security strategy.
The objective is not simply to add more security controls. It is to close the specific weaknesses attackers are actively exploiting.
How We Help
Our Identity & Access Risk Review helps organizations understand how authentication and access controls are implemented across their environment.
We evaluate areas such as MFA enforcement, legacy authentication risks, privileged accounts, guest access, and identity-related exceptions that may be overlooked during standard security reviews.
The result is a clearer understanding of where identity risks exist and what improvements will have the greatest security impact.