Topic starter
24/06/2026 8:05 pm
TL;DR: Traditional SMS codes, OTPs and push-based MFA are being bypassed through phishing, MFA fatigue and session hijacking, according to 1Kosmos, while organizations move toward passwordless, phishing-resistant and continuously verified authentication. Static login checks no longer match modern attack techniques, and identity assurance is shifting to methods that remove shared secrets entirely.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Modern Authentication Trends Beyond Traditional MFA”.
By the numbers:
- 60% of phishing-related breaches now use bypass techniques that traditional MFA cannot stop, according to 1Kosmos.
- Studies show that 1% of users blindly accept the first push notification they receive, according to 1Kosmos.
Key questions
Q: What breaks when traditional MFA is the only control protecting access?
A: Traditional MFA breaks when attackers can phish codes, trigger push fatigue or hijack the session after login.
Q: Why do phishing-resistant methods reduce account takeover risk?
A: Phishing-resistant methods reduce takeover risk because they rely on cryptographic proof instead of reusable secrets or user-entered codes.
Q: How can security teams tell whether machine authentication is actually working?
A: Machine authentication is working only if each client has a unique, verifiable identity and its access is limited to the exact systems it should reach.
Practitioner guidance
- Replace code-based MFA on high-risk access Prioritise privileged users, administrators and remote access paths for phishing-resistant methods such as passkeys, hardware keys or certificate-based authentication.
- Add adaptive risk checks to authentication flows Use device reputation, geolocation, time-of-day and behavioural signals to step up verification only when the access request looks abnormal.
- Extend monitoring beyond the login event Treat a successful login as the start of assurance, not the end.
Bottom line: Traditional MFA is no longer a reliable end state when attackers can phish codes, fatigue users and take over sessions after login.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:14 am
Traditional MFA is becoming a trust shim, not a control boundary. Once attackers can phish codes, pressure users into approvals, or hijack sessions, the old login checkpoint no longer defines where identity assurance ends. That pushes governance toward cryptographic proof and session-aware verification rather than relying on the same prompt structure for every access event.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations prioritise passwordless or privileged access modernisation first?
A: Most organisations should modernise privileged access controls first or in parallel, because the highest risk usually sits in service accounts, root access and shared administrative paths. Passwordless can improve user experience, but it does not address over-privilege, shared credentials or poor auditability on its own.
👉 Read our full editorial: Traditional MFA is giving way to phishing-resistant authentication