Traditional MFA is giving way to phishing-resistant authentication

At a glance

What this is: This article argues that traditional MFA is no longer enough because attackers can bypass SMS codes, OTPs and push approvals, pushing organizations toward passwordless and phishing-resistant authentication.

Why it matters: IAM teams need to treat authentication as a session-wide assurance problem, because human login controls that stop at the first prompt leave both workforce and customer access exposed to modern bypass techniques.

By the numbers:

• 60% of phishing-related breaches now use bypass techniques that traditional MFA cannot stop, according to 1Kosmos.
• Studies show that 1% of users blindly accept the first push notification they receive, according to 1Kosmos.

Context

Traditional MFA assumes that proving identity once at sign-in is enough to trust the rest of the session. That assumption breaks when attackers can phish codes, overwhelm users with push prompts, or hijack sessions after authentication.

For IAM and identity architects, the issue is not only authentication strength but authentication lifetime. The article frames modern authentication as a shift from one-time verification toward passwordless methods, adaptive risk checks and continuous validation across workforce and customer sessions.

The strongest signal here is that identity assurance is moving from shared secrets and static prompts to cryptographic proof and ongoing signal-based verification. That direction affects human IAM first, but it also changes how organizations think about session control for any identity subject that can be impersonated or replayed.

Key questions

Q: What breaks when traditional MFA is the only control protecting access?

A: Traditional MFA breaks when attackers can phish codes, trigger push fatigue or hijack the session after login. The control may still prove that a user answered a prompt, but it no longer guarantees that the current session is trustworthy. That is why authentication strategy now has to extend beyond the login event.

Q: Why do phishing-resistant methods reduce account takeover risk?

A: Phishing-resistant methods reduce takeover risk because they rely on cryptographic proof instead of reusable secrets or user-entered codes. A fake login page cannot steal a private key or replay a device-bound signature, so the attacker loses the simplest path from deception to impersonation.

Q: How can security teams tell whether machine authentication is actually working?

A: Machine authentication is working only if each client has a unique, verifiable identity and its access is limited to the exact systems it should reach. If credentials are shared, embedded broadly, or accepted across unrelated workflows, authentication may still succeed while governance fails. A good signal is whether revocation of one identity affects only one machine path.

Q: Should organisations prioritise passwordless or privileged access modernisation first?

A: Most organisations should modernise privileged access controls first or in parallel, because the highest risk usually sits in service accounts, root access and shared administrative paths. Passwordless can improve user experience, but it does not address over-privilege, shared credentials or poor auditability on its own.

Technical breakdown

Why traditional MFA breaks under phishing and MFA fatigue

Traditional MFA depends on a shared secret or a user approval event that can be intercepted, replayed or socially engineered. SMS one-time codes can be phished, push approvals can be fatigue-attacked, and session hijacking turns a successful login into a foothold that outlives the challenge. The problem is not authentication alone, but the fragility of the trust step that follows it. Once an attacker gets a valid session, the control path often stops checking identity at the point where the risk actually begins.

Practical implication: move high-risk access away from code-based approvals and design controls that survive session takeover.

How passkeys and phishing-resistant MFA change the trust model

Passkeys, FIDO2 security keys and certificate-based authentication replace reusable secrets with cryptographic proof tied to a device and a genuine relying party. Because the private key never leaves the device and the browser verifies the destination, a fake login page cannot collect something useful for replay. This is a different trust model from passwords plus MFA, which still relies on a user and a server sharing a secret or a short-lived code. The control shifts from resisting user error to making credential theft structurally unhelpful.

Practical implication: prioritise phishing-resistant methods for privileged users, high-value workflows and internet-facing access.

Why continuous authentication matters after login

Continuous authentication extends identity assurance beyond the initial challenge by monitoring behaviour, device posture, location and session activity. Behavioral biometrics, adaptive authentication and liveness checks all aim to answer the same question: is the current session still being used by the right person under expected conditions? That matters because many modern attacks do not need to beat the login page again once a session is established. Zero Trust thinking fits here, but only if verification continues after the first successful authentication event.

Practical implication: pair login hardening with session-level monitoring, step-up checks and termination rules when risk changes.

Threat narrative

Attacker objective: The attacker aims to obtain durable account access that survives the original MFA challenge and can be used for impersonation, data access or lateral movement.

1. Entry begins with phishing, MFA fatigue or another prompt-bombing technique that induces the user to reveal a code or approve access.
2. Credential abuse follows when the attacker reuses the captured code or session and pivots into the authenticated account.
3. Impact occurs when the attacker keeps access through session hijacking or post-login abuse that the original MFA challenge no longer governs.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Cisco Yanluowang breach 2022: A password synced to a personal Google account plus vishing and MFA fatigue opened Cisco's VPN; the attacker then abused machine accounts.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Traditional MFA is becoming a trust shim, not a control boundary. Once attackers can phish codes, pressure users into approvals, or hijack sessions, the old login checkpoint no longer defines where identity assurance ends. That pushes governance toward cryptographic proof and session-aware verification rather than relying on the same prompt structure for every access event.

Passwordless authentication changes the unit of protection from the secret to the device. That matters because the attack surface is no longer limited to guessing or stealing passwords, but to controlling the private key and the device state that guards it. For human IAM, this is the cleanest break from shared-secret risk.

Session continuity is now the real governance problem. Authentication programmes that measure success at login can miss the point entirely, because the attacker often arrives after a valid session already exists. The field needs to treat identity as an ongoing state, not a single event, which aligns with Zero Trust and continuous verification principles.

Phishing-resistant MFA should be treated as an access assurance floor, not a premium option. The market has moved far enough that code-based MFA now behaves like a transitional control, especially for high-value users and exposed applications. Practitioners should re-evaluate where code-based methods are still acceptable and where they are now an avoidable exposure.

Continuous verification is the named concept that best captures this shift. It describes the move from one-time authentication to identity checks that persist through the session and respond to changing risk. That concept will increasingly separate mature identity programmes from those still anchored to sign-in only.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Continuous verification is becoming the practical answer to a login model that assumes trust after the first successful challenge. Once push approval, code theft and session hijacking are in play, identity governance has to extend into the session itself rather than stopping at authentication.

For human IAM programmes, the key change is architectural, not cosmetic: replace reusable secrets where possible, then reserve step-up prompts for genuine risk changes instead of using them as the primary assurance mechanism. That is the direction modern authentication is already taking.

For practitioners

• Replace code-based MFA on high-risk access Prioritise privileged users, administrators and remote access paths for phishing-resistant methods such as passkeys, hardware keys or certificate-based authentication. These flows are the most attractive targets for phishing and prompt fatigue.
• Add adaptive risk checks to authentication flows Use device reputation, geolocation, time-of-day and behavioural signals to step up verification only when the access request looks abnormal. Keep low-risk sessions friction-light and high-risk sessions tightly challenged.
• Extend monitoring beyond the login event Treat a successful login as the start of assurance, not the end. Add session telemetry, behavioural biometrics and re-authentication triggers when user activity or device posture changes mid-session.
• Retire SMS OTP as a primary trust path Phase out SMS and reusable one-time passwords where the account risk justifies stronger controls. Use them only where no phishing-resistant alternative is yet feasible and document the residual exposure.
• Pilot passwordless access for the most targeted users Start with workforce populations that face repeated phishing pressure or hold high-value privileges. Use those rollouts to validate enrollment, recovery and device-bound credential governance before broader adoption.

Key takeaways

• Traditional MFA is no longer a reliable end state when attackers can phish codes, fatigue users and take over sessions after login.
• The article’s evidence points to a structural shift toward passwordless, phishing-resistant and continuously verified authentication.
• Identity teams should focus on cryptographic proof at login and session-level assurance after login, because both stages now matter.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Continuous authentication: A model where access is re-evaluated after the initial login instead of being trusted for the full session. It uses live signals such as posture, telemetry, and policy to detect when a session should be stepped up, constrained, or revoked.
• MFA Fatigue: MFA fatigue is the behavioural pressure created when repeated login prompts make a person more likely to approve access without checking carefully. It is a control failure in the authentication experience, and it becomes dangerous when the approved session carries broad privilege or long-lived access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.