Topic starter
08/06/2026 5:00 pm
TL;DR: Passwords are no longer enough, and five MFA types show why stronger factors such as security keys, biometrics, and certificates materially reduce compromise risk, according to StrongDM. The harder question is governance: identity controls must match the actor, access duration, and operational risk, not just add another login step.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “5 Types of Multi-Factor Authentication (MFA) Explained”.
By the numbers:
- The average data breach grew by 10% to $4.88 million in 2024, according to IBM.
- Researchers at Microsoft found that MFA can safeguard user credentials by up to 98.56%.
- Google research cited in the article found that SMS-based MFA blocked 70-100% of unauthorized login attempts, depending on attack type.
Key questions
Q: When does weak MFA create more risk than it removes?
A: Weak MFA creates more risk when the chosen factor is easy to intercept, clone, or fatigue-approve, but the account protects sensitive data or administrative access.
A: Hardware security keys bind authentication to a physical possession factor and only respond to legitimate websites and apps.
Q: What are the signs that authenticator-based MFA is failing?
A: Common signs include repeated approval prompts, users normalising unexpected notifications, and successful logins after no obvious credential reset or device change.
Practitioner guidance
- Define MFA by account class Set different authentication requirements for standard users, privileged users, contractors, and externally exposed access paths instead of applying one MFA policy everywhere.
- Prioritise phishing-resistant factors for high-risk access Use security keys or certificate-based authentication where takeover risk is highest, especially for admin consoles and sensitive internal systems.
- Remove approval-based fatigue paths Replace push-only approvals with methods that force an explicit code entry or possession check so repeated prompts cannot be accepted reflexively.
Bottom line: Passwords still fail as the primary line of defence because attackers target the authentication process itself, not just the protected system.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 6:56 pm
Password-only access is no longer the baseline problem. The real governance problem is that many identity programmes still assume a password is the primary credential and MFA is an optional add-on. That assumption fails as soon as credential theft becomes the dominant breach path. The result is not just weaker login security, but a programme design that underestimates how often authentication itself is the attack surface.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations use digital certificates for temporary access instead of passwords?
A: Yes, when access must be time-bounded and revocable, certificates are stronger than passwords because they can expire and be revoked as part of a lifecycle. The trade-off is governance overhead: if expiry and revocation are not managed well, the assurance benefit disappears. They fit best where temporary access is high value and tightly administered.
👉 Read our full editorial: Multi-factor authentication types show where passwords still fail
This post was modified 4 days ago by NHI Mgmt Group