Adaptive MFA is a response to authentication fatigue and attack abuse

At a glance

What this is: This is an analysis of how MFA fatigue weakens static authentication and why adaptive MFA changes the control model.

Why it matters: It matters because IAM teams have to balance user friction, phishing resistance, and step-up logic without creating approval fatigue that attackers can exploit.

By the numbers:

• 68% of users are frustrated by MFA prompts, according to Gartner, Forrester, and enterprise security surveys cited in the article.
• 23% of users approve MFA requests without reading them, according to Gartner, Forrester, and enterprise security surveys cited in the article.
• 40% of users actively seek MFA workarounds, according to Gartner, Forrester, and enterprise security surveys cited in the article.

👉 Read SecureAuth's analysis of adaptive MFA, fatigue attacks, and user friction

Context

MFA fatigue is a governance problem as much as an authentication problem. When users are trained to treat prompts as background noise, the control starts failing at the point where the human is expected to make a security decision. For IAM teams, that means the real issue is not MFA coverage, but whether the authentication model still matches how users actually behave under repeated challenge conditions.

Adaptive MFA is the attempt to move from fixed challenge patterns to risk-based authentication. The model still uses strong authentication, but it changes when and how the step-up happens based on device trust, location, time, behavior, and threat signals. That shift matters for human identity programmes because it replaces blanket friction with conditional friction, which is where modern access governance is heading.

Key questions

Q: How should security teams reduce MFA fatigue risk without weakening access control?

A: Security teams should reduce MFA fatigue risk by adding number matching, device binding, prompt throttling, and clear reporting paths for suspicious requests. The goal is to make approval harder to coerce and easier to verify, while also limiting the access a single approved session can reach through least privilege and session controls.

Q: Why do repeated MFA prompts create account takeover risk?

A: Repeated prompts work because they pressure the user into a fast decision. The attacker is not bypassing the factor directly. They are overwhelming the person behind it until one approval completes the session. That is why human vigilance alone is not a durable control and why organisations need context-aware step-up policies and stronger factors for higher-risk access.

Q: What are the warning signs that MFA is creating too much friction?

A: High prompt volumes, frequent approval times that look reflexive, rising help desk tickets, and users seeking workarounds all suggest the control is becoming counterproductive. If authentication is repeatedly interrupting low-risk sessions, teams should treat that as a design problem, not user resistance.

Q: Should organisations replace traditional MFA with passkeys and adaptive controls?

A: For most programmes, yes for the primary path and no for everything else. Passkeys should become the preferred method where device support allows it, while adaptive controls decide when extra checks are needed. Traditional MFA can remain as fallback, but it should no longer be the default for every login.

Technical breakdown

Why push-based MFA fails under fatigue pressure

Push-based MFA relies on user attention as a control surface. That works only when each prompt is treated as a deliberate security event, but fatigue attacks exploit repetition, timing, and interruption until approval becomes reflexive. The control failure is not cryptographic weakness. It is decision overload. Once an attacker has a password, the push channel becomes a pressure tool rather than a verifier, especially when notifications arrive during sleep or busy periods.

Practical implication: stop treating push approval as sufficient assurance on its own and evaluate where number matching or stronger phishing-resistant methods are required.

How adaptive MFA uses risk signals to change authentication depth

Adaptive MFA combines contextual signals such as device reputation, geography, timing, network location, and behavioral patterns into a real-time risk score. Low-risk sessions can proceed with less friction, while sensitive or anomalous sessions trigger extra checks. The architectural difference is that authentication becomes conditional rather than uniform. That makes it easier to apply stronger controls where the risk justifies them, instead of forcing every user through the same challenge path.

Practical implication: define which signals you trust, which actions should trigger step-up, and which populations need different policy thresholds.

Why passkeys and device trust change the authentication baseline

Passkeys remove the password from the initial authentication chain, which eliminates one of the most common preconditions for MFA fatigue and phishing follow-on. Device trust adds another layer by recognizing managed endpoints and reducing unnecessary prompts for known-good contexts. Together, they shift authentication from a repeated human decision to a combination of device assurance and cryptographic proof. The result is not fewer controls, but fewer low-value interruptions.

Practical implication: prioritize phishing-resistant authentication for higher-risk roles and use device attestation to reduce avoidable prompts on corporate-managed endpoints.

Threat narrative

Attacker objective: The attacker wants to convert stolen credentials into trusted access by wearing down the user until a single approval opens the account.

1. Entry begins when attackers obtain valid usernames and passwords through phishing, breach data, or other credential theft methods. Escalation starts when they flood the target with repeated MFA push notifications, often timed to maximize distraction or sleep deprivation. Impact occurs when the user approves a prompt without verifying context, giving the attacker account access and a path into enterprise systems and data.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Microsoft Midnight Blizzard breach — Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Adaptive MFA is a human identity control, not an authentication strategy in isolation. The article is right to frame MFA fatigue as an experience problem, because repeated prompts change user behavior. But for IAM practitioners, the deeper point is that the control only works when human judgment is still available. Once attackers turn the prompt into a nuisance, the control is being measured by its weakest interaction point, not its cryptographic strength. That means authentication policy has to be designed around how humans actually respond under pressure.

Prompt fatigue is a control failure that exposes the limit of static MFA. Static MFA assumes every login deserves the same treatment and that users can reliably distinguish routine prompts from attack traffic. The article shows why that assumption no longer holds in practice. In a large enterprise, the question is not whether MFA exists, but whether the organisation is using a control pattern that can survive repeated challenge abuse without training users to ignore it.

Number matching and device trust are governance signals, not just features. They show that authentication policy is moving toward context-based assurance, where the system decides when friction is justified. That matters for access governance because it creates a cleaner separation between low-risk and high-risk sessions, which is the real prerequisite for scaling zero trust with human users. The implication is that teams should treat adaptive policy as part of identity architecture, not as a UX layer.

The named concept here is authentication friction debt. Each unnecessary prompt adds a small amount of cognitive load, help desk overhead, and eventual policy bypass pressure. Over time, that debt becomes exploitable because users start making faster approval decisions than security teams expect. Practitioners should measure the accumulated cost of friction the same way they measure technical control drift, because both can create breach exposure.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• From our research: Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, according to The State of Non-Human Identity Security.
• Adaptive authentication becomes harder to govern when identity teams cannot see which connected applications are expanding the trust boundary in the first place.

What this signals

Authentication friction is becoming an identity governance metric, not just a user-experience metric. When 68% of users are frustrated by MFA prompts, the control is already shaping behaviour in ways security teams need to measure and manage. The practical lesson for IAM programmes is to track prompt volume, approval speed, and exception rates together, then correlate those metrics with help desk load and account risk.

As organisations move toward passkeys and adaptive policy, the control boundary shifts from login events to trust context. That is a better fit for human identity than static challenge loops, but only if device assurance and session policy are maintained consistently across the stack. Teams that treat adaptive MFA as a feature rollout will miss the governance work required to keep policy coherent across users, devices, and sensitive apps.

For practitioners

• Implement number matching for push notifications Require a user-entered code from the login screen so an approval must be tied to an active session, not just a vague notification.
• Classify and reduce low-risk prompt volume Map where prompts are occurring most often, then remove unnecessary challenges for managed devices, trusted networks, and low-risk sessions.
• Adopt phishing-resistant authentication for sensitive users Prioritize passkeys or other strong, phishing-resistant methods for administrators, finance users, and other high-impact accounts.
• Measure authentication friction as a risk signal Track prompt frequency, approval timing, and help desk volume together so MFA fatigue can be treated as a governance issue rather than a user complaint.

Key takeaways

• MFA fatigue turns repeated verification into a behavioural risk, which is why static push approval is no longer enough for many environments.
• The article’s evidence shows that user frustration, workaround behaviour, and prompt abuse are already common enough to make adaptive controls operationally necessary.
• Phishing-resistant authentication, device trust, and friction measurement are the controls that matter most when authentication has to stay both strong and usable.

Key terms

• MFA Fatigue: MFA fatigue is the behavioural pressure created when repeated login prompts make a person more likely to approve access without checking carefully. It is a control failure in the authentication experience, and it becomes dangerous when the approved session carries broad privilege or long-lived access.
• Adaptive MFA: A multi-factor authentication pattern that changes the challenge based on user context, risk, and policy. It reduces unnecessary friction by avoiding one-size-fits-all prompts, while still increasing assurance when a session, device, or location looks unusual.
• Number Matching: Number matching is an MFA method that requires the user to enter or confirm a number shown on the login screen. It reduces blind approvals by linking the approval to the specific session, which makes random taps or reflexive acceptance far less effective.
• Device Trust: Device trust is the confidence that a requesting endpoint is known, managed, and in a compliant state. It matters because identity alone does not prove safety. In zero trust programmes, device trust becomes one of the inputs used to decide whether access should be granted or sustained.

What's in the full article

SecureAuth's full article covers the implementation detail this post intentionally leaves in the source:

• Step-by-step adaptive MFA rollout phases from baseline analysis through expansion and optimisation
• The specific risk signals used to score authentication context, including device, geography, time, and behaviour
• Method-by-method comparison of SMS OTP, email OTP, push, biometrics, and FIDO2 passkeys
• Operational guidance on number matching, exception handling, and monitoring prompt fatigue metrics

👉 SecureAuth's full article covers the implementation journey, comparison table, and rollout guidance in more detail

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.