Multi-Factor Authentication (MFA): How It Protects Corporate Identities

Most successful breaches do not begin with a sophisticated exploit. They begin with stolen credentials. An attacker holding a valid username and password does not need to break anything: they simply log in, and security systems see user activity rather than an attack. Multi-factor authentication (MFA) answers that problem, and it remains the cheapest control with such a high return on effort.

Why a password alone is no longer enough

A password is a static secret, which means that once exposed it stays useful to an attacker until it is changed. The sources of exposure are numerous: breach databases, phishing, infostealer malware, reuse of the same password across personal and corporate services, and plain guessing in password spraying campaigns.

Complexity policies do not fix this. Forcing special characters and frequent rotation usually produces predictable patterns and passwords written down beyond the organisation’s control. A second, independent authentication factor changes the economics entirely: knowing the password is no longer sufficient to sign in.

What multi-factor authentication actually is

MFA is an identity verification method in which the user presents at least two independent proofs drawn from different categories:

• something you know: a password, a PIN, an answer to a recovery question,
• something you have: a phone with an authenticator app, a hardware key, a smart card, a device certificate,
• something you are: a fingerprint, facial geometry or another biometric trait.

The word “independent” carries the weight here. A password plus a security question is still a single factor, because both belong to the same category and both can be stolen the same way. Modern platforms add a fourth dimension on top of these three: context, meaning location, device posture, time of day and behavioural profile.

MFA methods and their real-world resistance

Not every MFA implementation offers comparable protection. It helps to rank them by increasing strength.

SMS and email one-time codes. The most common, the easiest to deploy and the weakest. They are vulnerable to interception on a phishing page, to number takeover through SIM swapping, and to weaknesses in operator signalling networks. Better than nothing, but not a destination for privileged accounts.

App-based TOTP codes. Generated locally, which removes the dependency on a mobile operator. They can still be harvested, however: the user types the code into a fake page and the attacker replays it in real time.

Push notifications. Convenient, and therefore popular, but exposed to user fatigue. The risk drops considerably with number matching, where the user retypes a digit sequence shown on the sign-in screen, and with rich context in the prompt (location, application, IP address).

Hardware keys and passkeys based on FIDO2 / WebAuthn. Authentication built on asymmetric cryptography and bound to the service domain. The private key never leaves the device and the signature is valid only for the legitimate domain, so a site impersonating the real portal gains nothing usable. This is the only category that can honestly be described as phishing-resistant.

Device certificates and smart cards. A strong fit for high-assurance environments, particularly where user identity should be tied to a specific managed device.

How attackers defeat MFA

Deploying MFA does not close the subject, because adversaries have adapted. Four scenarios dominate.

Adversary-in-the-middle phishing. The victim lands on a page that relays traffic to the genuine service in real time. The user supplies a password and a code, and the attacker captures a valid session token. Code-based factors offer no protection here, whereas FIDO2 blocks the attack at protocol level.

MFA fatigue. Holding a valid password, the attacker fires a burst of push prompts and waits for the user to approve one by mistake or out of irritation. Number matching and request throttling are the countermeasures.

SIM swapping. Porting a number to a SIM controlled by a criminal allows them to receive text messages. Senior staff and finance teams are the usual targets.

Session token theft. Malware lifts session cookies from the browser, letting the attacker skip authentication altogether. Shorter session lifetimes, token binding to the device and continuous risk evaluation after sign-in all help to contain it.

Adaptive MFA: security with less friction

Prompting for a second factor on every action wears users down and creates pressure to weaken the controls. Risk-based authentication evaluates the context of each attempt instead: is the device known and managed, is the location typical, does the time of day match established habits, have two sign-ins occurred from distant places within an impossible interval.

Low-risk sessions proceed without extra prompts. Elevated risk triggers a stronger factor, and high risk blocks the attempt and raises an alert. The outcome works in both directions: protection improves while the number of interruptions for employees falls.

Regulatory and market pressure

For many organisations MFA has stopped being optional. The NIS2 Directive lists multi-factor authentication among the baseline risk management measures for essential and important entities. DORA imposes equivalent expectations on the financial sector, and PCI DSS 4.0 extended the MFA requirement to all access into the cardholder data environment. GDPR does not name MFA explicitly, yet in practice supervisory authorities treat the absence of strong authentication as a failure to implement appropriate technical measures. MFA is also becoming a precondition for cyber insurance cover.