Traditional MFA limits and continuous authentication for passwordless access

At a glance

What this is: This is a SecureAuth analysis of why traditional MFA fails under fatigue attacks, phishing relays, and prompt overload, and why passwordless continuous authentication shifts assurance into the session.

Why it matters: It matters because IAM teams need controls that reduce user friction without leaving repeated challenge prompts as the main line of defence for human access.

Context

Traditional MFA relies on a prompt-and-approve model that assumes a user can reliably distinguish legitimate challenges from attack-driven ones. In practice, that assumption weakens when attackers use fatigue, real-time phishing relays, and repeated approval loops to push users into reflexive decisions.

For identity programmes, the issue is not just authentication strength at login. The article points toward session-aware assurance, where access is continuously re-evaluated through passkeys, device trust, behavioural signals, and risk-based step-up rather than through repeated interruption alone.

Key questions

Q: Why do repeated MFA prompts increase breach risk instead of proving stronger security?

A: Repeated prompts increase risk because they create fatigue, normalise approval behaviour, and turn authentication into a pressure test. A system that depends on a user to reject every hostile request can be worn down, especially when the attacker already has valid first-factor credentials and only needs one mistake.

Q: How should teams implement continuous authentication without overwhelming users?

A: Start by using strong primary authentication, then apply behavioural signals and device trust to lower friction for low-risk sessions. Reserve step-up for context changes that increase risk, such as anomalous behaviour or untrusted endpoints. The objective is to reduce challenge volume while making each challenge more meaningful when it appears.

Q: What signs show that MFA is becoming a liability instead of a control?

A: Warning signs include users receiving too many prompts, high approval rates under pressure, help desk reports about login friction, and repeated incidents where attackers exploit approved sessions rather than break credentials. If the control is teaching users to click first and think later, it is creating an exposure pattern the attacker can predict.

Q: How should organisations decide whether to prioritise passkeys over passwords?

A: Organisations should prioritise passkeys when they want stronger authentication with less user friction and a cleaner path toward passwordless access. Passkeys use device based proof of identity instead of shared secrets, which reduces reliance on passwords and can improve privacy. The decision depends on how well teams can integrate them into existing authentication flows.

Technical breakdown

Why prompt-based MFA fails under fatigue and relay attacks

Prompt-based MFA creates a narrow trust decision at the moment of login or step-up, but that decision is easy to manipulate when the user is overwhelmed or when an attacker proxies the challenge in real time. Fatigue attacks exploit repetition, while phishing relays capture valid session approval by sitting between the user and the service. The problem is not only weak factors, but the assumption that a single prompt can prove ongoing user intent. Once attackers can reuse the approved flow, the control loses most of its value.

Practical implication: treat repeated prompts as a weak assurance pattern unless they are backed by stronger, session-level signals.

How FIDO2 passkeys and device trust change the authentication model

FIDO2 passkeys replace shared secrets and OTP-style approval loops with phishing-resistant authenticators bound to the device and the relying party. Device trust adds context by reducing unnecessary prompts on verified endpoints, which lowers the number of opportunities for social engineering and user error. This does not eliminate the need for policy, but it changes the burden of proof: the session starts from stronger cryptographic assurance and can then use contextual factors to decide whether more verification is needed.

Practical implication: prioritise phishing-resistant authentication for the primary sign-in path and use device trust to suppress avoidable step-up prompts.

What continuous authentication changes after login

Continuous authentication moves the control point from a one-time event to the full session. Behavioural biometrics and risk scoring can detect drift in how a session is being used, while risk-based step-up can demand stronger proof only when the session becomes suspicious. This matters because many MFA failures happen after the initial login, when attackers ride an already-approved session. The architectural change is from prompt-centric assurance to ongoing confidence scoring across the session lifecycle.

Practical implication: design authentication policy to reassess trust during the session, not only at the front door.

Threat narrative

Attacker objective: The attacker wants a trusted session that looks legitimate to the identity system while granting access to corporate applications and data.

1. Entry begins when an attacker triggers repeated MFA prompts or inserts a real-time phishing relay to capture a valid approval from the user.
2. Credential access occurs when the attacker obtains a live authenticated session or approved challenge result that can be reused immediately.
3. Escalation follows as the attacker uses that authenticated state to move through protected applications without needing to defeat the factor again.
4. Impact is account compromise through legitimate-looking access that bypasses the protections users believed MFA provided.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.
• Cisco Yanluowang breach 2022: A password synced to a personal Google account plus vishing and MFA fatigue opened Cisco's VPN; the attacker then abused machine accounts.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt-driven MFA is an approval habit, not a durable trust model: When authentication depends on repeated user reactions, attackers target the human decision loop rather than the factor itself. That makes fatigue, relay, and consent-bypass attacks structurally predictable. The stronger programme question is whether assurance survives beyond the prompt.

Continuous authentication is really session governance for human identity: The article points to a shift from isolated challenge events to ongoing confidence management across the session. That aligns with zero standing trust thinking for access decisions, where access should remain conditional rather than permanently inherited after first approval. Practitioners should treat login as the start of assurance, not the end.

FIDO2 passkeys reduce one class of failure, but user experience still governs control adoption: Phishing-resistant authentication removes a common relay path, yet the article correctly keeps user friction in scope because poor usability drives unsafe workarounds and prompt fatigue. The programme implication is that assurance controls must be both resistant and sustainable, or users will route around them.

Session-aware assurance: traditional MFA assumes the important security decision happens once, but modern attack paths exploit what happens after that moment. That assumption breaks when approvals can be relayed or exhausted through repetition, so identity governance must follow the session rather than the single challenge. Practitioners need to redesign assurance around continuous trust decay and revalidation.

Authentication policy now has to distinguish inconvenience from risk: The article’s combination of device trust, behavioural biometrics, and risk-based step-up reflects a broader market shift toward selective verification. The operational goal is not fewer controls, but smarter control placement. Teams should expect identity assurance to become increasingly adaptive and context-dependent.

From our research library:

• eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.

What this signals

Continuous authentication changes the unit of control: security teams should stop treating identity assurance as a single login event and start treating it as an active session governance problem. That shift matters because prompt-driven MFA can fail after the first approval, when attackers are already inside the trust boundary.

Passwordless access only improves security when the programme removes the habit of repeated challenge loops and replaces it with stronger primary authentication plus selective revalidation. Without that change, MFA fatigue simply reappears in a more modern workflow.

Session-aware assurance: the practical design target is not maximum prompt volume, but the smallest number of well-placed verification events that still preserve confidence in who is using the session.

For practitioners

• Adopt phishing-resistant primary authentication Use FIDO2 passkeys for the default sign-in path so users are not relying on OTP-style approvals that can be relayed or fatigued into compromise.
• Reduce prompt volume with device trust Allow verified devices to suppress unnecessary step-up prompts, then reintroduce stronger checks only when device posture or session risk changes.
• Move verification into the session Apply behavioural biometrics and risk scoring continuously so access can be challenged again when the user pattern or context drifts.
• Limit approval loops that train unsafe behaviour Review workflows that repeatedly ask for MFA confirmation and remove low-value prompts that condition users to approve without scrutiny.

Key takeaways

• Traditional MFA is vulnerable when attackers can exploit human fatigue, relay a challenge in real time, or turn repeated prompts into a habitual click-through.
• SecureAuth's analysis places passkeys, behavioural biometrics, device trust, and risk-based step-up into a single model that shifts assurance from login-time to session-time.
• For IAM teams, the control objective is no longer just stronger authentication, but authentication that remains trustworthy after the first approval.

Key terms

• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Continuous authentication: A model where access is re-evaluated after the initial login instead of being trusted for the full session. It uses live signals such as posture, telemetry, and policy to detect when a session should be stepped up, constrained, or revoked.
• MFA Fatigue: MFA fatigue is the behavioural pressure created when repeated login prompts make a person more likely to approve access without checking carefully. It is a control failure in the authentication experience, and it becomes dangerous when the approved session carries broad privilege or long-lived access.
• Phishing-Relay Attack: An attack in which a victim's authentication exchange is captured and forwarded so the attacker can use the resulting session or proof. This is why prompt-based and code-based methods can remain risky even when they are technically multi-factor.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.