Older multi-factor authentication methods that add a second check but still depend on human response or reusable codes. In practice, SMS, voice, and push-based flows can reduce casual compromise while leaving room for phishing, fatigue attacks, and adversary-in-the-middle interception.
Expanded Definition
Legacy MFA refers to older authentication patterns that improve access control by adding a second factor, but still depend on human participation, reusable codes, or push approval. In NHI security, the concern is not that MFA is useless, but that these methods were designed for people at keyboards rather than for autonomous software entities, service accounts, or machine-to-machine workflows. Standards guidance such as NIST SP 800-53 Rev 5 Security and Privacy Controls emphasizes authentication strength and access control outcomes, while implementation details vary across vendors and environments. Legacy MFA often looks sufficient on paper, yet it can still be bypassed through phishing, prompt bombing, adversary-in-the-middle relays, or interception of SMS and voice flows.
Definitions vary across vendors when legacy MFA is described as “modern two-factor authentication,” but in NHI governance it is more useful to treat it as a transitional control with known exposure points. The most common misapplication is assuming a human-oriented MFA flow is equally protective for machine access, which occurs when service workflows inherit interactive login patterns instead of using purpose-built identity and secret controls.
Examples and Use Cases
Implementing legacy MFA rigorously often introduces user friction and operational overhead, requiring organisations to weigh faster login recovery against stronger resistance to social engineering and relay attacks.
- SMS one-time codes protect consumer-facing portals from password reuse, but they remain vulnerable to SIM swap and message interception.
- Voice call verification may satisfy a second-check requirement for low-risk access, yet it is weak against call forwarding abuse and phishing-assisted redirection.
- Push approvals can reduce casual compromise, but they create fatigue attack risk when users repeatedly approve alerts without verifying context.
- A service account that relies on an employee’s phone-based MFA for emergency access signals a governance gap, because machine identity control should not depend on human response.
- During investigations like the Microsoft Midnight Blizzard breach, weak or bypassable authentication patterns become a reminder that interactive protections do not automatically secure privileged non-human access.
For machine identity design, practitioners often compare these patterns against more explicit assurance requirements in NIST SP 800-53 Rev 5 Security and Privacy Controls and then shift high-risk workflows toward stronger, non-interactive controls.
Why It Matters in NHI Security
Legacy MFA matters because it can create a false sense of assurance while leaving the real identity path unchanged. If a secret is stolen, a token is phished, or an attacker can trigger repeated approvals, the organisation may still believe it has “two-factor protection” even though the compromise path remains open. That is especially dangerous in NHI environments, where the attacker is often targeting API keys, service accounts, automation agents, or administrative workflows rather than a single human login. The NHI Mgmt Group notes that 91.6% of secrets remain valid five days after notification, showing how slow remediation compounds the weakness of outdated authentication assumptions. In practice, legacy MFA can delay detection because teams focus on login prompts instead of credential lifecycle, rotation, and non-interactive trust boundaries.
Organisations typically encounter the operational cost of legacy MFA only after a phishing event, token replay, or account takeover reveals that the second factor did not meaningfully stop abuse, at which point the authentication model becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Addresses weak machine identity authentication patterns and overreliance on human-centric controls. |
| NIST SP 800-63 | AAL2 | Defines assurance levels that expose limits of reusable-code and push-based MFA methods. |
| NIST CSF 2.0 | PR.AA-1 | Identity and access management outcomes depend on authentication that resists common bypass techniques. |
| NIST Zero Trust (SP 800-207) | SC-4 | Zero Trust assumes explicit verification, which legacy MFA may only partially satisfy. |
| CSA MAESTRO | Agentic systems need authentication patterns that do not rely on human approval prompts. |
Replace legacy MFA dependencies with non-interactive machine identity controls and enforce stronger authentication paths.
