Topic starter
26/08/2026 11:51 am
TL;DR: Legacy MFA is no longer enough against deepfakes and modern phishing, according to Yubico’s commissioned Forrester TEI study, which found a composite 5,000-plus employee organisation achieved 265% ROI, 99.99% lower addressable breach risk costs, and $7.3 million in three-year benefits after moving to YubiKeys. The security model is shifting from checkbox authentication to phishing-resistant identity proofing, because OTP and push-based flows still leave enterprises exposed to account takeover and operational drag.
Editorial analysis by NHI Mgmt Group, based on content published by Yubico: “The 265% ROI of phishing resistance with Yubico: Why modern enterprises are ditching legacy MFA for YubiKeys”.
By the numbers:
- A composite organisation with 5,000-plus employees achieved a 265% ROI after switching to YubiKeys.
- The same organisation saw a 99.99% reduction in addressable breach risk costs.
Key questions
Q: What breaks when organisations rely on MFA alone for digital interactions?
A: MFA can confirm the user once, but it does not automatically protect the active session or the transaction being approved later.
Q: When does phishing-resistant MFA create more value than traditional MFA?
A: It creates the most value where credential theft, phishing, and session hijacking are recurring threats, especially for customer login, employee access, and privileged activity.
Q: How can teams tell whether their MFA design is actually strong enough?
A: Check whether the factor resists phishing, whether recovery preserves the same assurance, and whether sessions can be revoked quickly after suspicious behaviour.
Practitioner guidance
- Inventory MFA methods by phishing resistance Separate OTP SMS, push approval, and other replayable factors from cryptographic or device-bound methods so you know which logins remain interceptable.
- Set a deprecation path for legacy MFA Create a phased retirement plan for MFA methods that depend on user judgement under social pressure, especially where privileged access or high-risk systems are involved.
- Align authentication choice to user risk Require stronger methods for administrators, finance, support, and other roles that are likely phishing targets, rather than treating all users to the same assurance level.
Bottom line: Legacy MFA is still better than no MFA, but it no longer provides enough resistance against phishing, deepfakes, and prompt abuse in enterprise environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Legacy MFA is becoming a governance liability, not just a usability compromise. The article’s core claim is that OTP and push-based MFA still leave organisations exposed to phishing, deepfake-assisted impersonation, and approval fatigue. From an identity governance perspective, a control that can be socially engineered in real time is not merely weaker, it is operationally misaligned with current threat conditions. Practitioners should treat the authentication method, not the MFA label, as the control decision.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What should IAM teams do when legacy MFA still covers most users?
A: Prioritise high-risk populations and systems first, especially privileged users, help desk flows, and externally exposed applications. The goal is to remove the weakest authentication paths where the impact of takeover is highest, then expand to broader populations.
👉 Read our full editorial: Phishing-resistant MFA is becoming the baseline for enterprise identity