Topic starter
24/06/2026 5:40 pm
TL;DR: Unosecur's analysis of static and adaptive MFA finds that fixed prompts treat every login the same, even as device health, location, network reputation, and user behaviour change. Zero trust identity security needs assurance to rise and fall with session risk, not stay locked to one challenge pattern.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Adaptive vs Static MFA in Zero Trust”.
Key questions
Q: When does adaptive MFA reduce friction without weakening access security?
A: Adaptive MFA works best when the organisation uses context to distinguish routine access from risky access.
Q: What are the signs that a Zero Trust Execution policy is too rigid?
A: A policy is likely too rigid when ordinary production changes create high operational noise.
Q: What breaks when MFA is the same for every login in a zero trust model?
A: Static MFA breaks down when risk changes because it treats routine and suspicious sessions identically.
Practitioner guidance
- Define step-up trigger thresholds Map unmanaged devices, unusual locations, suspicious networks, privileged apps, and anomalous behaviour to explicit step-up rules in the identity provider.
- Remove blanket MFA exceptions Review executive and admin carve-outs that weaken assurance, then replace them with conditional access logic that still responds to risk.
- Tune risk signals before enforcement Validate that device posture, IP reputation, and behavioural telemetry are accurate enough to drive decisions without excessive false positives.
Bottom line: Static MFA creates a single authentication path for every session, which is too blunt for environments where risk changes in real time.
Glossary terms: Adaptive MFA, Static MFA, Step-up Authentication, Continuous Verification
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- The article's side-by-side explanation of static MFA and adaptive MFA in Zero Trust identity security.
- The specific risk signals the vendor lists for step-up access decisions, including device health and behaviour.
- The compliance and business implications discussed for MFA fatigue, user experience, and regulatory alignment.
- The FAQ examples that show how the vendor frames practical deployment questions.
👉 Read Unosecur's analysis of adaptive MFA and zero trust identity security →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/06/2026 3:37 am
Adaptive MFA is a policy decision about trust decay, not just a better login experience. Static MFA assumes the same assurance level is appropriate for every access attempt, but zero trust assumes the opposite. Once device, location, or behaviour changes, the original trust decision weakens and must be re-evaluated. Practitioners should design authentication as a moving control point, not a fixed gate.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How can IAM teams make authentication stronger without adding too much friction?
A: Use adaptive authentication so low-risk sessions stay simple while higher-risk logins trigger stronger proof. Combine trusted devices, phishing-resistant factors, and clear recovery paths to avoid repeated unnecessary challenges. The goal is not more prompts, but better assurance per prompt.
👉 Read our full editorial: Adaptive MFA is reshaping Zero Trust identity security