Topic starter
12/06/2026 10:10 pm
TL;DR: Cisco’s breach analysis shows that stolen credentials, push-notification fatigue, and vishing can still defeat conventional MFA when attackers target the human approval path, according to Axiad. Phishing-resistant authentication and tighter push-app controls remain the practical answer, not more confidence in passwords or basic push prompts.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Lessons Learned from the Cisco Data Breach”.
Key questions
Q: What breaks when push-based MFA is the main control for privileged access?
A: Push-based MFA breaks down when attackers can flood users with prompts or impersonate support staff into approving one.
Q: Why do stolen credentials still matter in environments with MFA?
A: Stolen credentials matter because they are often the first step in a chain that ends with social engineering or MFA fatigue.
Q: What are the signs that MFA fatigue is being used against users?
A: Common signs include a burst of push requests, approvals that happen after several denials, unexpected enrolment of a new device, and suspicious sign-ins that align with user distraction or help desk impersonation.
Practitioner guidance
- Restrict push-app registration paths Allow push enrollment only from trusted contexts and review any workflow that lets a user add a new device without strong verification.
- Move high-risk access to phishing-resistant methods Prioritise FIDO2 or other phishing-resistant authentication for privileged users, remote access, and applications that handle sensitive data.
- Detect MFA fatigue patterns early Watch for repeated push requests, unusual approval timing, and sign-in attempts that cluster around the same account or device.
Bottom line: The Cisco breach shows that push-based MFA can still fail when attackers combine stolen credentials with fatigue and vishing.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/06/2026 12:45 am
Push-based MFA is not a complete defence when the attacker can move the decision to the user. The Cisco breach shows that approval becomes the attack surface once the credential is already valid. That is not a failure of authentication in the abstract. It is a failure mode in which human consent is treated as a reliable security signal when it can be socially engineered.
A question worth separating out:
Q: When should organisations replace legacy MFA with phishing-resistant MFA?
A: They should do it first for privileged accounts, remote access, and any workflow that attackers can target with phishing or adversary-in-the-middle attacks. If the access path protects sensitive systems and the current factor can be replayed or approved out of band, the upgrade should move from backlog to priority.
👉 Read our full editorial: Cisco breach lessons show MFA fatigue remains an identity risk