Topic starter
10/07/2026 4:15 pm
TL;DR: Basic MFA methods are being bypassed through Adversary-in-the-Middle proxy attacks, MFA fatigue, and social engineering, while phishing-resistant MFA uses cryptography and domain binding to stop credential interception, according to Versasec. The governance issue is no longer whether MFA exists, but whether it can survive real phishing conditions and lifecycle scale.
Editorial analysis by NHI Mgmt Group, based on content published by Versasec: “Beyond the Basics: Why Enterprises Need Phishing-Resistant MFA”.
By the numbers:
- The U.S. federal government has required phishing-resistant MFA across its agencies since OMB Memorandum M-22-09.
Key questions
Q: What breaks when risk-based authentication still relies on OTPs and push approvals?
A: The control breaks when it assumes factor completion equals identity verification.
Q: Why do phishing-resistant authenticators lower the risk of adversary-in-the-middle attacks?
A: Phishing-resistant authenticators lower AiTM risk because they cryptographically bind the response to the registered origin.
Q: What signals show that MFA is not actually phishing-resistant?
A: Look for SMS, OTP, push approvals, and broad exception use on high-value accounts.
Practitioner guidance
- Replace phishable second factors Prioritise FIDO2/WebAuthn or certificate-based authentication for high-risk applications, especially where AiTM and push fatigue are realistic threats.
- Centralise credential issuance and revocation Tie token issuance, PIN reset, replacement and offboarding to a single governance process so valid credentials cannot outlive user status changes.
- Test real phishing conditions Validate whether login controls still hold when users are routed through a look-alike domain, a proxy or a fake approval prompt.
Bottom line: Basic MFA still fails when attackers can intercept or relay the second factor, so the control boundary matters more than the number of factors deployed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 4:17 pm
Shared-secret MFA is the broken assumption: Basic MFA was designed for a world where the second factor stayed with the user long enough to prove presence. AiTM proxies and prompt bombing break that assumption because the factor is now relayable and phishable at the moment of use. The implication is that login assurance can no longer be measured by factor count alone.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How should organisations govern phishing-resistant authentication at scale?
A: Treat phishing-resistant authentication as a lifecycle programme, not a one-time factor choice. Organisations need control over issuance, renewal, recovery, and revocation, plus clear ownership across IAM, IGA, and device teams. If fallback paths remain weak, strong credentials will still be bypassed through reset workflows and exception handling.
👉 Read our full editorial: Phishing-resistant MFA exposes the limits of basic login controls