Topic starter
12/06/2026 10:17 pm
TL;DR: Basic MFA methods such as SMS, OTPs, and push approvals still leave organisations exposed to phishing, SIM swapping, and man-in-the-middle attacks, according to Axiad, while more secure options like FIDO2/WebAuthn and PKI remain underused because teams perceive them as complex and costly. The real issue is that “good enough” MFA often satisfies compliance without materially changing the attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Today’s “Good Enough MFA” Should Be Phishing-Resistant”.
By the numbers:
- 93% of organisations are still using passwords at work or for business, according to an Axiad survey of more than 200 IT professionals.
- more than 200 IT professionals
Key questions
Q: What is the difference between strong MFA and phishing-resistant MFA?
A: Strong MFA means more than one factor is used, while phishing-resistant MFA means the factor cannot be easily captured and replayed by an attacker.
Q: Why do organisations still get compromised even after deploying MFA?
A: Because MFA is not a single control, it is a control design.
Q: How should IAM teams decide when phishing-resistant authentication is needed?
A: Use phishing-resistant methods wherever account compromise would create material business or operational impact, especially for remote access, privileged users, and high-value applications.
Practitioner guidance
- Prioritise phishing-resistant MFA for privileged accounts Move administrators, help-desk operators, and access to sensitive internal tools onto FIDO2/WebAuthn or certificate-based authentication first, because those accounts carry the highest blast radius if phished.
- Inventory where basic MFA still creates exposure Map SMS, OTP, and push approval use across applications, then flag the systems where relay attacks or push fatigue would produce the most damaging compromise.
- Separate compliance coverage from assurance coverage Track not only whether MFA is enabled, but whether the deployed factor resists phishing, man-in-the-middle interception, and code replay in the current access path.
Bottom line: Basic MFA can satisfy policy requirements while still leaving organisations exposed to phishing and relay attacks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
13/06/2026 12:57 am
Compliance-grade MFA is not the same as phishing-resistant identity security: The article shows how teams can satisfy an MFA mandate while leaving the attacker’s path largely unchanged. The control exists, but the trust model still allows relay attacks, SIM swap abuse, and approval fatigue. For IAM leaders, that means security posture is being measured by deployment presence instead of attacker resistance.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations replace SMS and OTP MFA first, or focus on privileged access first?
A: Focus on privileged access first. The highest-value accounts are where phishing-resistant methods deliver the greatest risk reduction, while low-risk populations can be transitioned later without leaving the organisation’s most sensitive systems exposed. Sequencing by blast radius is usually more defensible than a broad, equal-speed migration.
👉 Read our full editorial: Good enough MFA leaves identity teams exposed to phishing
This post was modified 5 days ago by NHI Mgmt Group