Topic starter
11/07/2026 8:22 pm
TL;DR: Organisations remain exposed when passwords are weak, reused, or compromised, because Duo MFA’s second factor does not inspect the first factor against breach intelligence, according to Enzoic. The practical gap is credential hygiene, not MFA strength, and that is where continuous screening changes the control model.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “Compromised Password Detection in Duo”.
Key questions
Q: What should security teams do first when passwords can still be compromised even with MFA in place?
A: Start by blocking known breached and weak passwords at creation and reset time, then verify that those checks happen before the MFA challenge.
Q: Why do compromised-password checks matter if MFA is already deployed?
A: MFA reduces some account takeover paths, but it does not make a reused or breached password harmless.
Q: How can teams tell whether password screening is actually working?
A: Look for rejected weak or breached password choices at set time, plus alerts or forced changes when an active password later appears in new breach data.
Practitioner guidance
- Enforce breached-password blocking at creation and reset Check new passwords against breach intelligence and reject credentials that match known compromised or commonly abused patterns before they are accepted.
- Add continuous post-set monitoring for active passwords Revalidate stored passwords against updated breach feeds so credentials that become unsafe later can be flagged or forced to change at next login.
- Separate first-factor hygiene from MFA policy Document password screening as its own control objective so MFA rollout metrics do not mask weak first-factor governance.
Bottom line: MFA reduces login risk, but it does not validate whether the password itself is weak, reused, or already compromised.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:52 pm
MFA alone does not govern password quality: The control answers a different question from compromised-password screening, so the two should not be conflated. A second factor can prove possession without proving the password has not already been exposed or reused. The implication is that identity programmes must govern credential quality as a separate control plane, not as an assumed by-product of MFA.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations treat password screening as part of MFA or as a separate control?
A: Treat it as a separate control that complements MFA. MFA verifies the second factor, while screening governs whether the first factor should be allowed to exist at all. Keeping those responsibilities distinct makes the authentication stack easier to assess and audit.
👉 Read our full editorial: Compromised password screening closes the gap MFA leaves open