MFA is not the finish line

Rolling out multi factor authentication is one of the highest return things a security team can do, and if you have not finished doing it, finish doing it before reading the rest of this.

But somewhere along the way MFA became a box that gets ticked and then stops being examined. Meanwhile the people on the other side adapted, as they always do, and a meaningful share of intrusions now happen against accounts that had MFA enabled the whole time.

How MFA gets around these days

Four methods, none of them exotic, all of them in routine use.

Real time proxy phishing. The victim lands on a convincing sign in page that is actually a relay. They enter the password, they receive the genuine prompt, they approve it, and the relay captures the resulting session. The factor worked exactly as designed and the attacker is inside anyway.

Push fatigue. Repeated prompts, often late at night, until somebody approves one to make it stop. It sounds like it should not work. It works often enough to remain popular.

Session theft. If the attacker obtains a valid session token, through malware or a proxy, they never meet the authentication step at all. The token is the credential at that point.

The gaps in the rollout. Legacy protocols that predate MFA, service accounts nobody enrolled, break glass accounts with a documented exception, contractors on a temporary arrangement that became permanent. Coverage is almost never as complete as the project report said.

If approving a prompt is all it takes, then anything that can convince a person to approve a prompt is all it takes.

What actually resists this

The distinction that matters is whether the factor can be relayed. Phishing resistant methods bind the authentication to the legitimate site, so a relay in the middle does not work even if the user is fully convinced.

You do not need to move everybody at once, and for most organisations that is not realistic. Move the accounts where the consequence is highest. Administrators, finance approvers, anyone who can change payment details, and anyone with access to the identity system itself.

The five things to check this month

1. Where is MFA not enforced? Find the exceptions. Legacy protocols, service accounts, break glass, contractors. The exception list is where intrusions start.
2. Do sessions end when a password changes? If a stolen token survives a password reset, your response to a compromise does not actually contain it.
3. How long do sessions live? Convenient session lengths are the reason token theft is worth doing.
4. What can a helpdesk reset, and on what proof? Social engineering the reset path skips authentication entirely, and this route is used constantly.
5. Are your non human accounts anywhere in this? They rarely rotate, they often hold more privilege than any person, and nobody reviews them. We wrote about that in the access review nobody reads.

Identity is the perimeter now

The wider point is that in a cloud estate, identity decides nearly everything. Network position matters less every year, while who can assume which role, and which of those paths end in administrative control, decides how far an intrusion travels.

Those paths are rarely obvious from an organisation chart and are usually shorter than anyone expects. Mapping what a single compromised identity actually reaches is the same traversal problem as mapping what a weak system reaches, which is the ground ControlGraph is built on.

The CIS Controls treat account and access management as foundational, and the NIST Cybersecurity Framework puts identity at the front of the Protect function. Both are useful if you need to make the case internally that this deserves more than a completed rollout ticket.

Where to start if you only do one thing

Move your administrators to hardware keys or passkeys. It is a small population, the consequence of compromise is the highest in the organisation, and it removes the single most productive attack path available against you.

Then go and find the exceptions list. It is longer than you think, and everything on it is a door that was left open deliberately and then forgotten.

Common questions

Is SMS based MFA still worth having

It is far better than no second factor and worth keeping where the alternative is nothing. It does not resist proxy phishing or SIM swap, so it should not be the protection on administrative accounts or anything that can move money.

What is phishing resistant MFA

Authentication that is cryptographically bound to the legitimate site, so a relay sitting in the middle cannot reuse it. In practice that means hardware security keys or platform passkeys rather than codes or push approvals.

Do passkeys replace passwords entirely

They can, and that is the direction of travel, but most organisations run both for some time. The practical near term win is using them on the highest consequence accounts rather than attempting a complete replacement immediately.

How do attackers bypass MFA without the user noticing

Usually the user does notice something, they just do not recognise it as an attack. They enter credentials on a convincing page and approve a prompt that arrives at exactly the moment they expect one. From their side the sign in worked, which is why it goes unreported.