MFA Beyond the Basics: Why Not All Multi-Factor Authentication Is Equal

If you've deployed multi-factor authentication across your organization, congratulations, you've taken one of the most impactful steps in cybersecurity. But if you stopped at SMS text codes, you've only gotten halfway there.

Not all MFA is created equal. The method you choose determines how well it actually protects your accounts, and some methods that felt secure a few years ago are now routinely bypassed by attackers.

Here's what you need to know about MFA methods and what your organization should be using.

The MFA Hierarchy

Think of MFA methods as a spectrum from weakest to strongest. Each step up significantly reduces your risk of compromise.

The MFA Fatigue Attack: What Executives Need to Know

One of the most concerning developments in recent years is the MFA fatigue attack. Here's how it works:

1. An attacker obtains a valid username and password (often from a previous breach)
2. They attempt to log in, triggering an MFA push notification to the employee's phone
3. The employee denies it. The attacker tries again. And again. And again.
4. After receiving dozens of prompts at 2 AM, the exhausted or frustrated employee finally taps "Approve" just to make it stop

This isn't theoretical. MFA fatigue attacks have been used in high-profile breaches at major companies. The fix is straightforward: require number matching on push notifications. Instead of a simple approve/deny button, the employee must enter a number displayed on the login screen. This prevents blind approval.

What Executives Should Mandate

You don't need to understand the cryptographic details. You need to make three decisions:

First, mandate MFA everywhere. No exceptions. If a system doesn't support MFA, that's a risk that needs to be documented, and you should evaluate whether that system should remain in your environment.

Second, move beyond SMS. Authenticator apps should be your minimum standard. For high-value targets, executives, finance team, IT administrators, require hardware keys or passkeys.

Third, require phishing-resistant MFA for privileged accounts. Admin accounts, financial systems, and any account with access to sensitive data should use FIDO2 security keys or passkeys. These methods are immune to phishing because they cryptographically verify the website you're logging into, preventing credential interception.

The Passkey Opportunity

Passkeys are the newest addition to the MFA hierarchy, and they deserve your attention. Built on the same FIDO2 standard as hardware security keys, passkeys provide phishing-resistant authentication without requiring employees to carry a physical device.

Passkeys work through your phone's biometrics (fingerprint or face recognition) and sync across devices. They're supported by Apple, Google, and Microsoft, and adoption is growing rapidly.

For SMBs, passkeys represent an opportunity to deploy enterprise-grade authentication without the cost and logistics of distributing hardware keys to every employee. Ask your IT team whether your critical applications support passkeys today, and build a migration plan for the ones that do.

Key Takeaways

For more on rolling out stronger authentication without disrupting productivity, see Cybersecurity for CEOs.