Phishing-resistant MFA is becoming the baseline for enterprise identity

At a glance

What this is: This is a vendor-authored analysis and commissioned TEI study arguing that legacy MFA no longer matches current phishing and deepfake risk, and that phishing-resistant authentication changes both security and operating economics.

Why it matters: IAM teams should read this as a signal that authentication posture is shifting from convenience-driven MFA coverage to phishing-resistant controls that reduce takeover risk, help desk load, and recovery effort across human identity programmes.

By the numbers:

• A composite organisation with 5,000-plus employees achieved a 265% ROI after switching to YubiKeys.
• The same organisation saw a 99.99% reduction in addressable breach risk costs.

Context

Legacy MFA becomes fragile when the threat shifts from password guessing to phishing kits, session theft, and synthetic impersonation. In that environment, OTPs and push approvals still rely on a human spotting a trap in real time, which is exactly the weak point modern social engineering exploits.

This article uses a commissioned Forrester TEI study to argue that phishing-resistant MFA is now a baseline control for enterprise identity, not an optional hardening step. The identity governance question is whether organisations can still treat legacy MFA as sufficient when the business cost of account takeover, reset volume, and user friction is already visible.

For human identity programmes, the key issue is not whether MFA exists, but whether the method resists phishing, replay, and approval fatigue. That distinction matters because governance teams often report MFA coverage as a success metric even when the underlying authentication method remains highly interceptable.

Key questions

Q: What breaks when organisations rely on MFA alone for digital interactions?

A: MFA can confirm the user once, but it does not automatically protect the active session or the transaction being approved later. Attackers can still hijack a session, manipulate a mobile workflow, or abuse a valid login to authorise a high-value action. Stronger assurance has to follow the interaction, not stop at the prompt.

Q: When does phishing-resistant MFA create more value than traditional MFA?

A: It creates the most value where credential theft, phishing, and session hijacking are recurring threats, especially for customer login, employee access, and privileged activity. Traditional MFA still relies on factors that can be intercepted or replayed, while phishing-resistant methods bind authentication to the device and reduce replay risk.

Q: How can teams tell whether their MFA design is actually strong enough?

A: Check whether the factor resists phishing, whether recovery preserves the same assurance, and whether sessions can be revoked quickly after suspicious behaviour. If any of those three steps are weaker than the login flow, the programme is still exposed.

Q: What should IAM teams do when legacy MFA still covers most users?

A: Prioritise high-risk populations and systems first, especially privileged users, help desk flows, and externally exposed applications. The goal is to remove the weakest authentication paths where the impact of takeover is highest, then expand to broader populations.

Technical breakdown

Why OTP and push MFA fail under modern phishing

OTP SMS codes and push approvals are authentication factors, but they are not phishing-resistant because the user can still be tricked into revealing or approving them during a live attack. Deepfakes and AI-assisted social engineering increase the plausibility of the lure, while adversaries use real-time proxying and prompt pressure to capture or relay the factor. The control problem is not factor count alone, but whether the factor can be replayed or socially engineered out of the user. That is why basic MFA often reduces risk only partially rather than breaking the attack chain.

Practical implication: prioritise phishing-resistant methods over add-on factors that attackers can still intercept or socially engineer.

Phishing-resistant MFA as an authentication baseline

Phishing-resistant MFA binds authentication to a cryptographic device or authenticator that cannot be casually copied from a message or approval screen. In the article’s framing, YubiKeys are used as the practical example of this model because they support stronger authentication flows for modern and legacy systems. For IAM teams, the architectural shift is from shared human decision points, such as approving a prompt, to possession-bound proof that is much harder to relay or replay. That changes both the trust model and the governance conversation around acceptable login methods.

Practical implication: define an enterprise-approved set of phishing-resistant authentication methods and phase out weaker login flows.

Why identity economics now matter to security design

The article ties authentication choice to operational economics, not just breach prevention. Reset tickets, investigation effort, and user productivity losses all sit downstream of how the organisation authenticates people. That matters because identity programmes are often judged on rollout coverage while the hidden operating cost of weak MFA stays buried in service desk demand and incident response time. A control that lowers takeover likelihood while reducing recovery work changes the programme from a defensive cost centre into a broader resilience investment.

Practical implication: evaluate MFA modernisation with both risk reduction and operational burden in scope.

Threat narrative

Attacker objective: The attacker aims to gain durable account access by bypassing weak MFA and using the authenticated session as a foothold for broader compromise.

1. Entry occurs when attackers use phishing, deepfake-enabled impersonation, or social engineering to target a human user’s authentication flow.
2. Credential capture or approval abuse follows when the victim discloses an OTP, accepts a push prompt, or otherwise grants access through a weak MFA method.
3. Impact is account takeover, which can then drive further access to enterprise systems, customer data, or administrative tooling.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy MFA is becoming a governance liability, not just a usability compromise. The article’s core claim is that OTP and push-based MFA still leave organisations exposed to phishing, deepfake-assisted impersonation, and approval fatigue. From an identity governance perspective, a control that can be socially engineered in real time is not merely weaker, it is operationally misaligned with current threat conditions. Practitioners should treat the authentication method, not the MFA label, as the control decision.

Phishing-resistant authentication is now the more defensible baseline for human identity programmes. When the human user is the weakest link in the authentication sequence, adding more prompts does not solve the trust problem. The governance question shifts to which methods bind access to a device or cryptographic authenticator rather than to a user’s momentary judgement. That is the line between MFA as a box-check and MFA as a control.

Identity security investment is increasingly measured through business friction as well as breach prevention. The article links stronger authentication to fewer password reset tickets, faster logins, and lower investigation overhead. That matters because IAM and IGA leaders rarely get credit for the operational cost of weak authentication until the service desk and incident queues tell the story. The implication is that authentication modernisation should be evaluated as an identity operating model decision, not a narrow security product choice.

Human use of NHI thinking is the wrong mental model for authentication governance. This is not about treating people like workloads, but about recognising that human authentication still has to withstand machine-assisted phishing at machine speed. The old assumption was that a user could reliably judge a login challenge under pressure. That assumption fails when the attacker can script the persuasion step, so the programme has to redefine acceptable assurance for human access.

Phishing-resistant identity proofing is the concept this article sharpens. The useful distinction is not between MFA and no MFA, but between factors that can be relayed and factors that resist real-time interception. For practitioners, that means the baseline is moving from coverage metrics to assurance quality. Teams that still report MFA adoption without method quality are measuring the wrong control.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Authentication quality is becoming a board-level identity issue. Coverage alone no longer tells the full story when attackers can proxy or socially engineer a login in real time. Identity teams should expect more scrutiny of which MFA methods are deployed, where phishing resistance is required, and how quickly legacy flows can be retired.

Legacy MFA creates trust debt across the access lifecycle. The hidden cost is not just exposure during login, but the ongoing operational work needed to recover from failed access, compromised sessions, and user friction. Programmes that modernise authentication now will be better placed to simplify support and improve resilience later.

For practitioners

• Inventory MFA methods by phishing resistance Separate OTP SMS, push approval, and other replayable factors from cryptographic or device-bound methods so you know which logins remain interceptable.
• Set a deprecation path for legacy MFA Create a phased retirement plan for MFA methods that depend on user judgement under social pressure, especially where privileged access or high-risk systems are involved.
• Align authentication choice to user risk Require stronger methods for administrators, finance, support, and other roles that are likely phishing targets, rather than treating all users to the same assurance level.
• Measure operational drag from weak MFA Track password reset volume, help desk tickets, and login failure patterns alongside compromise metrics so the case for modernisation includes business friction as well as security risk.

Key takeaways

• Legacy MFA is still better than no MFA, but it no longer provides enough resistance against phishing, deepfakes, and prompt abuse in enterprise environments.
• The Forrester TEI study cited by Yubico ties stronger authentication to measurable business value, including lower breach risk costs and reduced support burden.
• IAM teams should assess authentication methods by phishing resistance, not by MFA labels alone, and retire replayable factors where risk is highest.

Key terms

• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Deepfake Social Engineering: Deepfake social engineering uses AI-generated voice, video, or written content to impersonate trusted people or organisations. The attack works by exploiting human confidence in familiar cues, especially in workflows where identity checks rely on tone, appearance, or conversational context.
• Authentication Assurance: The degree of confidence that an identity has been verified to the intended standard before access is granted. For MFA, assurance depends on the whole enforcement chain, including session handling, retry policy, and telemetry, not merely the presence of a code prompt.
• Identity Trust Debt: The accumulation of access relationships that were once justified but are now stale, excessive, or poorly owned. In SaaS and NHI environments, trust debt grows when discovery outpaces revocation and the organisation begins treating unresolved access as normal.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.