Legacy MFA creates risk because it can train users to approve requests automatically and because attacker-in-the-middle phishing can intercept or replay credentials. That makes the factor easy to bypass in real-world abuse even when policy says MFA is enabled. For insurers, this weakens confidence in the control. For defenders, it means the quality of MFA matters, not just its presence.
Why legacy MFA becomes a liability instead of a control
Legacy MFA often stops being a meaningful barrier when users are trained to approve repeated prompts, when push fatigue becomes normalised, or when a second factor can be intercepted in transit. The problem is not that the control disappears, but that its actual resistance to phishing and session theft is much lower than policy language suggests.
That is why insurers and defenders should treat “MFA enabled” as an incomplete statement. The real question is whether the deployed method resists attacker-in-the-middle phishing, token replay, and prompt abuse, or whether it mainly adds friction without materially raising the attacker’s cost.
- Push-based and one-time-code methods can be usable, but they are far easier to social-engineer than phishing-resistant authenticators.
- Once users learn that repeated prompts are normal, approval becomes a habit rather than a security decision.
- For this reason, control quality matters more than control presence.
A useful way to think about the issue is that legacy MFA protects the login step, but many modern account-takeover attacks target the factor itself, the approval behaviour, or the resulting session. That is why legacy MFA can fail even when it appears to be functioning correctly.
How attackers turn weak MFA into account takeover
Attacker-in-the-middle phishing is especially effective against legacy MFA because the victim enters credentials and the second factor into a live proxy, allowing the attacker to capture the authenticated session or tokens. In other cases, a fatigue attack pressures the user into approving a request they did not initiate, which converts a human workflow problem into a compromise.
The practical result is that account takeover may happen without a traditional password-cracking event. Once the session is established, the attacker often needs no further MFA challenge, which is why downstream impact can include mailbox access, SaaS control-plane abuse, internal tool access, or secret theft.
- Proxy-based phishing defeats methods that do not bind authentication to the origin or device.
- Approval-based factors are vulnerable when the user is conditioned to trust repeated prompts.
- Session tokens can outlive the original login event, so the compromise persists after the initial prompt.
For a concrete example of the abuse pattern, see Microsoft Midnight Blizzard breach and Uber Breach, both of which illustrate how social engineering and MFA fatigue can be used to bypass user-facing protections. The broader pattern is also visible in The 52 NHI breaches Report, where credential and token abuse repeatedly shows up as an attack path once initial access is obtained.
What cyber insurers and defenders should actually measure
Insurers are not really pricing “MFA,” they are pricing the strength of authentication assurance, the likelihood of phishing resistance, and the expected blast radius if one factor is abused. Defenders should therefore distinguish between legacy MFA methods and stronger phishing-resistant options, because the former may satisfy a checklist while still leaving a high account-takeover probability.
That distinction matters because weak MFA changes claims expectations, incident frequency, and recovery cost. If an insurer assumes the organisation has phishing-resistant authentication but the environment relies on push approvals or codes, the control environment is overstated and the residual risk is higher than underwriters may have modelled.
- Measure how often users receive repeated prompts, because high prompt volume can indicate fatigue exposure.
- Track how many accounts still rely on methods that are susceptible to replay or interception.
- Prioritise privileged, email, finance, and admin pathways first, since compromise there has the highest downstream impact.
For practitioners, the best evidence is not the MFA policy document but the method mix, user behaviour, and whether the control resists real phishing. CISA cyber threat advisories are useful for tracking current abuse patterns, while CIS Controls v8 provides a practical baseline for account management and access control hygiene. For organisations already evaluating stronger authentication standards, PCI DSS v4.0 is a useful benchmark because it pushes teams toward tighter access control expectations.
Practitioner Guidance: Do not treat legacy MFA as a binary pass or fail. If the method can be socially engineered, replayed, or converted into a session token, it should be assessed as a partial control with a clear residual account-takeover risk.
What to verify: Confirm which authenticator types are actually in use, where push approval is still allowed, and whether high-value accounts are protected by phishing-resistant methods rather than legacy factors.
Decision rule: If an MFA method can be satisfied by user approval alone or by credentials plus a reusable code, prioritise migration for privileged and externally exposed accounts first, because those paths carry the highest insurer and takeover impact.
Practitioner takeaway: The meaningful question is not whether MFA exists, but whether it still meaningfully resists the attack paths that modern adversaries use against it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 6 — Access Control Management | Weak MFA turns access control into a soft target for account takeover. |
| 5 — Account Management | Legacy MFA risk rises when account state, access paths, and prompt exposure are poorly governed. | |
| 8 — Audit Log Management | MFA fatigue and phishing often surface as repeated prompts and anomalous sign-in patterns. | |
| Recommendation — Enforce stronger account controls and remove weak authentication paths from high-value access. Inventory and harden accounts that still rely on legacy MFA methods. Centralise and review authentication logs for repeated prompt abuse and impossible travel patterns. | ||
| NIST CSF 2.0 | PR.AC-7 — Users, Devices, Data, and Other Assets Are Authenticated | The question is about the strength and assurance of authentication itself. |
| PR.AC-3 — Remote Access Is Managed | Attacker-in-the-middle phishing commonly abuses remote access and sign-in flows. | |
| GV.RM-1 — Risk Management Strategy | Insurers price control quality, not just MFA presence, so assurance quality must be governed. | |
| Recommendation — Require phishing-resistant authentication for sensitive access paths. Restrict and harden remote authentication paths that can be proxied or replayed. Classify legacy MFA as a residual-risk issue in your risk strategy. | ||
| NIST SP 800-63 | AAL2 — Authenticator Assurance Level 2 | Legacy MFA often maps to weaker assurance that can be phished or replayed. |
| AAL3 — Authenticator Assurance Level 3 | Phishing-resistant authentication directly addresses the abuse pattern described. | |
| Recommendation — Use higher-assurance authenticators where account takeover consequences are material. Adopt phishing-resistant authenticators for privileged and high-impact accounts. | ||
| MITRE ATT&CK | T1566 — Phishing | Legacy MFA is commonly bypassed through phishing and attacker-in-the-middle flows. |
| Recommendation — Hunt for phishing infrastructure and proxy-based sign-in abuse. | ||
