Topic starter
24/06/2026 9:30 pm
TL;DR: MFA maturity is shifting into risk-based access decisions tied to application context, session state and governance, according to 1Kosmos. Credential quality, DevOps handling and session duration now shape whether the control stays effective across the access lifecycle.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Navigating Gartner's Seven Tracks to MFA Maturity with 1Kosmos”.
Key questions
Q: Why do MFA programmes fail when DevOps teams are not involved?
A: Because implementation drift usually starts in delivery pipelines, configuration defaults and exception handling.
Q: What signs show that MFA is not mature enough for production risk?
A: Frequent exceptions, inconsistent enforcement across applications, weak credential hygiene and long-lived sessions all suggest the control is not being governed as part of the access lifecycle.
Q: How should teams move from checklist MFA to risk-based access decisions?
A: Start by classifying applications, data and workflows by sensitivity, then map the level of authentication strength to each tier.
Practitioner guidance
- Define risk tiers for MFA enforcement Map applications, assets and workflows to risk tiers so authentication strength is proportional to the sensitivity of the action being protected.
- Embed MFA requirements into DevOps workflows Add MFA configuration, testing and exception handling to release pipelines so implementation quality is verified before deployment.
- Harden credential controls around MFA Reduce weak, reused and stale credentials so the assurance provided by MFA is not undermined by poor credential hygiene.
Bottom line: MFA maturity is shifting from a deployment checklist to a governed access decision that changes with risk, application context and session state.
Glossary terms: Risk-Based MFA, Credential Integrity, Session Management, Authentication Drift
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 6:43 am
MFA maturity is now a governance problem, not a feature problem. The article is really describing a shift from deploying authentication to governing trust decisions across the access lifecycle. Once MFA is treated as a binary rollout, teams miss the harder questions about risk tiering, implementation consistency and session durability. The implication is that IAM programmes need to measure MFA as a control system, not as a checkbox.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations treat credential controls and session management as part of MFA governance?
A: Yes. MFA only delivers durable assurance when credential quality and session lifespan are managed alongside the login control itself. Weak passwords, reused credentials and sessions that remain valid after risk changes all reduce the practical value of the authentication step.
👉 Read our full editorial: MFA maturity is shifting from checklist controls to risk-based access