Topic starter
08/06/2026 4:10 pm
TL;DR: Basic MFA methods like SMS, OTPs, and push approvals remain vulnerable to phishing, SIM swapping, and man-in-the-middle attacks, while a survey cited by Axiad found 93% of organisations still use passwords for business. The practical shift is to treat phishing-resistant MFA as the baseline for human identity, not an optional hardening step.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Today’s “Good Enough MFA” Should Be Phishing-Resistant”.
By the numbers:
- 93% of organizations are still using passwords at work or for business.
Key questions
Q: What breaks when MFA is present but the login can still be relayed in real time?
A: MFA stops simple credential replay, but it does not stop an attacker who can proxy the live login flow and inherit the resulting session.
Q: Why do phishing-resistant authenticators lower the risk of adversary-in-the-middle attacks?
A: Phishing-resistant authenticators lower AiTM risk because they cryptographically bind the response to the registered origin.
Q: How should IAM teams prioritise MFA migration?
A: Start with privileged access, remote access and any service that would expose sensitive data or administrative control if compromised.
Practitioner guidance
- Adopt phishing-resistant MFA for privileged and remote access Prioritise FIDO2, WebAuthn or PKI-based authentication for administrator portals, VPN access and other externally reachable human login paths.
- Retire relayable second factors on high-value systems Phase out SMS, OTP and push approval flows where account takeover would expose internal tools, privileged consoles or sensitive customer data.
- Classify authenticator risk by attack resistance Review each authentication method for susceptibility to phishing, SIM swapping, MitM relay and prompt bombing, then rank migration by exposure.
Bottom line: Basic MFA can still be phished, proxied or manipulated, which leaves human identity flows exposed even when a second factor is present.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 5:39 pm
Phishing-resistant MFA is now the baseline, not the upgrade path: Basic MFA only shifts the attack from the password to the second factor, and that second factor is often relayable or socially engineerable. Once phishing, SIM swapping and man-in-the-middle interception are in scope, the control is no longer sufficient for high-value human access. Practitioners should stop treating “MFA enabled” as a complete governance answer.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations still accept SMS and OTP for business access?
A: They should only do so where the business impact of takeover is low and where stronger options are not yet feasible. For anything that touches admin functions, sensitive data or internal applications, SMS and OTP are too easy to intercept or socially engineer to serve as a durable baseline.
👉 Read our full editorial: Phishing-resistant MFA is now the baseline for identity security
This post was modified 4 days ago by NHI Mgmt Group