Topic starter
02/09/2026 3:57 pm
TL;DR: MFA fatigue is turning repeated prompts into a security and productivity problem, with Gartner, Forrester, and enterprise surveys cited in the SecureAuth article showing 68% of users frustrated by prompts and 156% growth in fatigue attacks. The case for adaptive MFA is no longer about convenience alone: static MFA assumes user attention is reliable, while attackers deliberately exploit the gap between prompt volume and human judgment.
Editorial analysis by NHI Mgmt Group, based on content published by SecureAuth: “How to Reduce MFA Friction While Keeping Your Enterprise Secure”.
By the numbers:
- 68% of users are frustrated by MFA prompts, according to SecureAuth.
- 40% actively seek workarounds, according to SecureAuth.
- 156% increase in MFA fatigue attacks, according to SecureAuth.
Key questions
Q: What breaks when MFA prompts and access checks create authentication fatigue?
A: When prompts become repetitive, people stop paying attention and may approve requests without thinking.
Q: Why do repeated MFA prompts create account takeover risk?
A: Repeated prompts work because they pressure the user into a fast decision.
Q: How can security teams tell whether adaptive MFA is working properly?
A: Look for a lower challenge rate on routine sessions, a higher challenge rate on suspicious transactions, and stable or improved conversion.
Practitioner guidance
- Measure prompt fatigue before changing policy Track prompt frequency, approval latency, help desk tickets, and user-reported friction by application and user group so you can separate real risk from avoidable noise.
- Deploy number matching on push notifications Require a code or matching challenge for push approval so repeated prompts cannot be accepted reflexively during fatigue attacks.
- Introduce device trust for managed endpoints Use certificate-based attestation and device registration so known corporate devices can receive streamlined authentication while unknown devices trigger stronger checks.
Bottom line: MFA fatigue turns repeated approval prompts into a control weakness because users eventually respond reflexively instead of deliberately.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/09/2026 3:58 pm
Adaptive MFA is a governance response to human attention limits, not just an authentication tuning exercise. The article shows that repeated prompts change user behaviour, which means the control design itself has become part of the attack surface. In identity programmes, that shifts MFA from a binary enablement question to a question of how often a challenge remains trustworthy. The practitioner takeaway is that MFA policy must be measured against user decision quality, not just deployment coverage.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: When should organisations use passkeys instead of push approvals?
A: Use passkeys when phishing resistance and user experience both matter, especially for workforce access that is frequently targeted by password theft and push spam. Passkeys remove password reuse from the equation and reduce prompt dependency. Push approvals should become a fallback method, not the default trust mechanism, where stronger options are available.
👉 Read our full editorial: Adaptive MFA is a response to authentication fatigue and attack abuse
This post was modified 2 days ago by NHI Mgmt Group