Topic starter
11/07/2026 2:01 pm
TL;DR: MFA fatigue turns repeated prompts into a security weakness, and prompt bombing can pressure users into approving unauthorized access, according to GlobalSign’s analysis. The underlying issue is that authentication designs still assume users can sustain constant vigilance, which is no longer a safe governance assumption.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “La verdad sobre la fatiga de la Autenticación Multifactor (MFA)”.
Key questions
Q: What breaks when users can be bombarded into approving MFA prompts?
A: The control breaks when approval is treated as proof of intent.
Q: Why does prompt bombing increase account takeover risk?
A: Prompt bombing increases takeover risk because it turns a legitimate authentication channel into a pressure tactic.
Q: How should security teams reduce the risk of MFA fatigue attacks?
A: Security teams should remove approval-based MFA from high-risk access paths, replace it with cryptographic authentication, and reduce the privileges attached to any successful session.
Practitioner guidance
- Audit prompt frequency and approval paths Map where users receive repeated MFA requests, then separate normal access from abnormal access so high-risk requests do not look routine.
- Introduce context-aware challenge policies Use device familiarity, location, and session risk to decide when MFA should step up, rather than prompting on every login.
- Replace approval-only paths for sensitive access For privileged or high-impact applications, require stronger verification than a single yes/no notification so one fatigued response cannot complete the login.
Bottom line: MFA fatigue turns user frustration into a security weakness when repeated prompts become normal enough to trigger automatic approval.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:10 pm
MFA fatigue is a human control failure, not a user training problem. The repeated-prompt pattern shows that authentication systems can be functionally correct while still producing insecure outcomes because people are asked to stay vigilant far beyond normal attention limits. That makes usability part of the security model, not a cosmetic concern. The practical conclusion is that human identity controls need to be judged by how they shape decisions under pressure, not by how many prompts they can generate.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations keep push-based MFA for all applications?
A: No. Push-based MFA is reasonable for lower-risk use cases, but it becomes fragile where a single approval opens access to sensitive data or administration tools. Teams should reserve stronger verification for high-impact systems and use contextual challenge policies so authentication matches the risk of the session.
👉 Read our full editorial: MFA fatigue exposes a usability gap in human identity security