Topic starter
24/06/2026 9:30 pm
TL;DR: Gartner's seven-track MFA maturity model is a move away from checklist authentication toward risk-based design, stronger DevOps guidance, credential controls and session management, according to 1Kosmos. The governance shift matters because MFA only holds up when it is treated as a lifecycle control, not a one-time deployment.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Navigating Gartner's Seven Tracks to MFA Maturity with 1Kosmos”.
Key questions
Q: How should teams move from checklist MFA to risk-based access decisions?
A: Start by classifying applications, data and workflows by sensitivity, then map the level of authentication strength to each tier.
Q: Why do MFA programmes fail when DevOps teams are not involved?
A: Because implementation drift usually starts in delivery pipelines, configuration defaults and exception handling.
Q: What signs show that MFA is not mature enough for production risk?
A: Frequent exceptions, inconsistent enforcement across applications, weak credential hygiene and long-lived sessions all suggest the control is not being governed as part of the access lifecycle.
Practitioner guidance
- Define risk tiers for MFA enforcement Map applications, assets and workflows to risk tiers so authentication strength is proportional to the sensitivity of the action being protected.
- Embed MFA requirements into DevOps workflows Add MFA configuration, testing and exception handling to release pipelines so implementation quality is verified before deployment.
- Harden credential controls around MFA Reduce weak, reused and stale credentials so the assurance provided by MFA is not undermined by poor credential hygiene.
Bottom line: MFA maturity is shifting from a deployment checklist to a governed access decision that changes with risk, application context and session state.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:43 am
MFA maturity is now a governance problem, not a feature problem. The article is really describing a shift from deploying authentication to governing trust decisions across the access lifecycle. Once MFA is treated as a binary rollout, teams miss the harder questions about risk tiering, implementation consistency and session durability. The implication is that IAM programmes need to measure MFA as a control system, not as a checkbox.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations treat credential controls and session management as part of MFA governance?
A: Yes. MFA only delivers durable assurance when credential quality and session lifespan are managed alongside the login control itself. Weak passwords, reused credentials and sessions that remain valid after risk changes all reduce the practical value of the authentication step.
👉 Read our full editorial: MFA maturity is shifting from checklist controls to risk-based access