Notifications
Clear all
Topic starter
11/07/2026 1:55 pm
TL;DR: Regulators and industry bodies are pushing financial services toward broader MFA coverage, tighter exception governance, and phishing-resistant methods because passwords, OTPs, and weak legacy access paths remain easy to steal or break, according to Secret Double Octopus. The defensible position is no longer “we have MFA,” but whether coverage, method strength, and evidence align across workforce, third parties, and privileged access.
NHIMG editorial — based on content published by Secret Double Octopus: The Financial-Services Authentication Reset: MFA, Phishing Resistance, and What Regulators Now Expect
Questions worth separating out
Q: How should financial institutions close MFA gaps across legacy systems?
A: Start by inventorying every legacy access path, then classify each one by business risk and authentication strength.
Q: Why do passwords and OTPs still create risk in regulated environments?
A: Passwords and OTPs remain risky because they can be stolen, phished, replayed, or bypassed through recovery flows and inconsistent enforcement.
Q: How do security teams know whether phishing-resistant MFA is actually working?
A: Look for evidence that the strongest method is enforced on the highest-risk access paths, that fallback options are limited, and that exception counts are shrinking over time.
Practitioner guidance
- Inventory every authentication path Map workforce, contractor, third-party, privileged, remote, and legacy access routes, then identify where passwords, OTPs, or single-factor fallbacks still exist.
- Require stronger methods for high-risk access Set phishing-resistant authentication as the default for privileged and remote access, and reserve weaker methods only for formally approved exceptions with expiry and compensating controls.
- Build exception governance into IAM reporting Track every MFA exception with an owner, remediation date, and business justification, then report coverage and exception aging to risk and leadership teams on a recurring basis.
What's in the full article
Secret Double Octopus' full article covers the regulatory detail this post intentionally leaves for the source:
- Section-by-section interpretation of NYDFS Part 500 MFA expectations for covered entities
- Practical comparison of FFIEC, NCUA, PCI DSS 4.x, NIST 800-63, and FINRA guidance
- Checklist language for exception governance, evidence collection, and leadership reporting
- Discussion of passwordless claims versus genuine phishing-resistant authentication
👉 Read Secret Double Octopus' analysis of financial-services MFA and regulator expectations →
Financial-services MFA: are your controls meeting current regulator expectations?
Explore further
11/07/2026 2:06 pm
Coverage without method strength is a false comfort. Financial-services programmes often report MFA coverage as if adoption alone were the control, but regulators are moving toward assurance, not checkbox presence. Passwords, OTPs, and weak recovery paths leave a program exposed even when policy says MFA is in place. The practitioner conclusion is simple: measure control strength, not just control existence.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to the 2024 Non-Human Identity Security Report.
- Only 23.5% of security professionals are unsure about the biggest threat to their non-human identities, indicating a significant awareness gap.
A question worth separating out:
Q: Who is accountable when MFA coverage is incomplete?
A: Accountability sits with the business and identity owners who approve the exception, the security team that governs the control, and the system owner who keeps the weak path alive. For regulated firms, incomplete MFA coverage should be tracked as a risk decision, not treated as an implementation detail.
👉 Read our full editorial: Financial-services MFA is now a coverage and assurance problem
