Enhanced authentication shows why MFA strategy is still fragmented

At a glance

What this is: This article argues that MFA programmes are still fragmented across silos, leaving organisations exposed to phishing, prompt-bombing, and inconsistent authentication controls.

Why it matters: This matters because IAM teams have to judge MFA by coverage, resistance, and usability across human and machine access, not by whether a factor was added somewhere in the stack.

By the numbers:

• 70% of Security/IT professionals say they are overwhelmed by the complexity of their authentication systems.
• Almost 85% of organisations experienced a cyberattack in the last year.
• Almost 9 in 10 organisations plan to implement a passwordless strategy in the next 12 months or have already done so.
• Almost 1 in 2 security executives say multiple, disjointed authentication silos are a top challenge for improving cybersecurity practices.

Context

Authentication is the control that proves a person or system is who or what it claims to be, but in practice it is now spread across passwords, MFA variants, passwordless options, and disconnected IAM ecosystems. That fragmentation creates uneven assurance and inconsistent user experience, which makes the control harder to govern and easier to bypass.

For IAM programmes, the problem is not simply whether MFA is deployed. The harder question is whether the organisation has a coherent authentication strategy that is phishing-resistant, usable, and consistent across applications, operating systems, and identity domains.

Key questions

Q: What breaks when MFA is not native to the identity platform?

A: When MFA is not native to the identity platform, enforcement often becomes uneven across applications, user groups, and access paths. That inconsistency creates audit gaps and leaves privileged or remote sessions exposed to credential theft. Security teams then have to prove control effectiveness across multiple layers instead of one authoritative policy plane.

Q: Why do phishing-resistant MFA methods matter if attackers can still get in?

A: They materially reduce real-time credential harvesting and replay attacks, which removes one of the easiest entry paths. But they do not stop an attacker who already controls a valid session through social engineering, stolen tokens, or compromised administrators. The practical goal is to reduce entry opportunities and then limit post-login blast radius.

Q: How should organisations choose an MFA method that improves security without creating excessive user friction?

A: Organisations should choose MFA based on risk, usability, and inclusivity together, not on security alone. Strong MFA should resist phishing and credential theft while remaining simple enough for users to complete quickly on the devices they already have. Methods that depend on weak factors, complicated steps, or narrow hardware support often reduce completion rates and push users toward insecure workarounds.

Q: Should teams move to passwordless before fixing MFA fragmentation?

A: Not necessarily. Passwordless can reduce password risk and user friction, but it does not solve fragmented governance, inconsistent recovery, or weak assurance paths on its own. Teams should first define the authentication standard they want across environments, then use passwordless where it improves that standard rather than replacing it.

Technical breakdown

Why fragmented MFA weakens authentication assurance

Multi-factor authentication is only as strong as the factor, the enrolment path, and the enforcement point. When organisations run different MFA methods across different applications or operating systems, the assurance level varies by context, and attackers look for the weakest route. That is how a programme can appear broad on paper while still leaving exploitable gaps in coverage, recovery flows, or step-up enforcement. Fragmentation also complicates governance because policy becomes local to each stack instead of consistent across the identity estate.

Practical implication: Standardise authentication policy and map where different MFA methods create uneven assurance across environments.

Phishing resistance and prompt-bombing resistance are not the same control

The article separates MFA from phishing-resistant authentication, which is an important distinction. Some MFA methods can still be captured by adversaries through phishing, while others are vulnerable to prompt bombing, where repeated push requests pressure users into approval. That means security teams need to evaluate not only whether a second factor exists, but whether the factor resists real attacker behaviour. Authentication design has to match the threat model, not just satisfy a checklist.

Practical implication: Test authentication methods against phishing and approval fatigue before treating them as equivalent risk controls.

Passwordless changes friction, not governance requirements

Passwordless adoption is presented as a response to friction, but it does not remove the need for strong identity governance. Removing passwords can reduce user burden and cut common attack paths, yet the organisation still has to manage enrolment, recovery, lifecycle offboarding, and assurance across use cases. In other words, passwordless is a delivery model for authentication, not a substitute for identity policy. The governance challenge shifts from secret handling to proofing, binding, and recovery control.

Practical implication: Treat passwordless as an architecture decision that still requires lifecycle and recovery governance.

NHI Mgmt Group analysis

Fragmented MFA is a governance problem, not just a tooling problem. When authentication is implemented differently across silos, the organisation no longer has one assurance model. That makes policy enforcement inconsistent and creates places where weaker controls survive because no one owns the full end-to-end path. For identity teams, the issue is programme coherence, not factor count.

Phishing resistance is the real dividing line in modern authentication. The article is right to separate generic MFA from stronger forms of authentication that resist phishing and prompt-bombing. A second factor that can still be socially engineered does not close the attack path, it only changes it. Practitioners should evaluate authentication methods by attacker interaction, not by label.

Authentication complexity is now a user-risk multiplier. When controls become hard to use, users look for bypasses, workarounds, or helpdesk exceptions, and that turns friction into exposure. The policy lesson is that security teams must design for usable assurance, because control abandonment is a predictable outcome when authentication feels punitive.

Authentication silos create identity attack surface debt: each disconnected MFA deployment adds a new recovery flow, enrolment path, and exception set that attackers can exploit and operators must govern. That debt accumulates across applications, operating systems, and business units, so the organisation inherits more variation than assurance. Teams should treat consolidation of authentication policy as a security objective, not only an administrative cleanup.

Passwordless adoption is best understood as a transition in control design. It reduces password dependency, but it does not eliminate the need to bind identities, control recovery, or govern assurance levels across environments. The practitioners who win here are the ones who treat passwordless as part of a broader authentication architecture rather than a standalone endpoint.

What this signals

Authentication programmes need architectural coherence, not just more factors. The practical risk in fragmented MFA is not that one control exists or does not exist, but that different business units and platforms enforce different assurance levels. Identity teams should prioritise policy consolidation because inconsistency is where bypasses and exceptions accumulate.

Phishing resistance should be the benchmark for high-risk access. If an MFA method can still be approved by accident or captured through phishing, it belongs in the lower-assurance bucket. Authentication strategy should separate low-risk convenience access from privileged and sensitive workflows that demand stronger resistance.

Authentication complexity creates governance debt. Each extra enrolment path, recovery flow, and exception process adds operational surface area that has to be managed over time. The longer those silos persist, the harder it becomes to deliver a consistent identity experience or enforce one policy baseline.

For practitioners

• Map authentication silos across the identity estate Inventory where MFA methods differ by application, operating system, or use case, then identify where those differences create uneven assurance or exception paths.
• Prioritise phishing-resistant authentication for high-risk access Move sensitive administrative and privileged workflows to authentication methods that resist phishing and prompt-bombing instead of accepting generic MFA coverage as sufficient.
• Reduce user friction before users create bypasses Review enrolment, recovery, and step-up flows for places where complexity is driving helpdesk workarounds, repeated prompts, or informal exceptions.
• Align passwordless rollout with lifecycle governance Treat passwordless as part of identity lifecycle design, including enrolment, recovery, and deprovisioning controls, so the change improves assurance rather than just usability.

Key takeaways

• Fragmented MFA leaves organisations with multiple assurance levels, which weakens governance even when authentication is broadly deployed.
• The article highlights phishing resistance, prompt-bombing resistance, and user friction as the main tests for a modern authentication strategy.
• IAM teams should consolidate authentication policy, reduce exceptions, and treat passwordless as part of a broader governance design.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Prompt Bombing: An attacker technique that floods a user with repeated MFA requests until one is approved out of confusion, fatigue, or annoyance. It works because the control depends on a human making a quick decision under pressure, rather than on a factor that cannot be socially engineered.
• Authentication Fragmentation: A state where different teams, systems, or identity types use different login methods, policy rules, or enforcement points. Fragmentation weakens governance because visibility drops and exceptions multiply, making it harder to prove that the organisation has one coherent access control model.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.