Topic starter
12/06/2026 10:11 pm
TL;DR: Authentication complexity is overwhelming 70% of Security and IT professionals, almost 85% of organisations experienced a cyberattack in the last year, and nearly 9 in 10 say they plan to implement passwordless within 12 months, according to Axiad and IDSA. The real issue is not whether MFA exists, but whether it is phishing-resistant, usable, and consistent across silos.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Navigating the Path to Enhanced Authentication”.
By the numbers:
- 70% of Security/IT professionals say they are overwhelmed by the complexity of their authentication systems.
- Almost 85% of organisations experienced a cyberattack in the last year.
- Almost 9 in 10 organisations plan to implement a passwordless strategy in the next 12 months or have already done so.
Key questions
Q: What breaks when MFA is not native to the identity platform?
A: When MFA is not native to the identity platform, enforcement often becomes uneven across applications, user groups, and access paths.
Q: Why do phishing-resistant MFA methods matter if attackers can still get in?
A: They materially reduce real-time credential harvesting and replay attacks, which removes one of the easiest entry paths.
A: Organisations should choose MFA based on risk, usability, and inclusivity together, not on security alone.
Practitioner guidance
- Map authentication silos across the identity estate Inventory where MFA methods differ by application, operating system, or use case, then identify where those differences create uneven assurance or exception paths.
- Prioritise phishing-resistant authentication for high-risk access Move sensitive administrative and privileged workflows to authentication methods that resist phishing and prompt-bombing instead of accepting generic MFA coverage as sufficient.
- Reduce user friction before users create bypasses Review enrolment, recovery, and step-up flows for places where complexity is driving helpdesk workarounds, repeated prompts, or informal exceptions.
Bottom line: Fragmented MFA leaves organisations with multiple assurance levels, which weakens governance even when authentication is broadly deployed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 12:47 am
Fragmented MFA is a governance problem, not just a tooling problem. When authentication is implemented differently across silos, the organisation no longer has one assurance model. That makes policy enforcement inconsistent and creates places where weaker controls survive because no one owns the full end-to-end path. For identity teams, the issue is programme coherence, not factor count.
A question worth separating out:
Q: Should teams move to passwordless before fixing MFA fragmentation?
A: Not necessarily. Passwordless can reduce password risk and user friction, but it does not solve fragmented governance, inconsistent recovery, or weak assurance paths on its own. Teams should first define the authentication standard they want across environments, then use passwordless where it improves that standard rather than replacing it.
👉 Read our full editorial: Enhanced authentication shows why MFA strategy is still fragmented
This post was modified 6 days ago by NHI Mgmt Group