Topic starter
02/09/2026 3:58 pm
TL;DR: Traditional MFA still breaks down under fatigue attacks, phishing relays, and user friction, according to SecureAuth, which positions passwordless continuous authentication as a way to combine FIDO2 passkeys, behavioral biometrics, risk-based step-up, and device trust. The real shift is that identity assurance must become session-aware instead of prompt-driven, because repeated challenge loops are easy to abuse and hard for users to sustain.
Editorial analysis by NHI Mgmt Group, based on content published by SecureAuth: “Tackling MFA Challenges with Passwordless Continuous Authentication”.
Key questions
Q: Why do repeated MFA prompts increase breach risk instead of proving stronger security?
A: Repeated prompts increase risk because they create fatigue, normalise approval behaviour, and turn authentication into a pressure test.
Q: How should teams implement continuous authentication without overwhelming users?
A: Start by using strong primary authentication, then apply behavioural signals and device trust to lower friction for low-risk sessions.
Q: What signs show that MFA is becoming a liability instead of a control?
A: Warning signs include users receiving too many prompts, high approval rates under pressure, help desk reports about login friction, and repeated incidents where attackers exploit approved sessions rather than break credentials.
Practitioner guidance
- Adopt phishing-resistant primary authentication Use FIDO2 passkeys for the default sign-in path so users are not relying on OTP-style approvals that can be relayed or fatigued into compromise.
- Reduce prompt volume with device trust Allow verified devices to suppress unnecessary step-up prompts, then reintroduce stronger checks only when device posture or session risk changes.
- Move verification into the session Apply behavioural biometrics and risk scoring continuously so access can be challenged again when the user pattern or context drifts.
Bottom line: Traditional MFA is vulnerable when attackers can exploit human fatigue, relay a challenge in real time, or turn repeated prompts into a habitual click-through.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/09/2026 3:58 pm
Prompt-driven MFA is an approval habit, not a durable trust model: When authentication depends on repeated user reactions, attackers target the human decision loop rather than the factor itself. That makes fatigue, relay, and consent-bypass attacks structurally predictable. The stronger programme question is whether assurance survives beyond the prompt.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: How should organisations decide whether to prioritise passkeys over passwords?
A: Organisations should prioritise passkeys when they want stronger authentication with less user friction and a cleaner path toward passwordless access. Passkeys use device based proof of identity instead of shared secrets, which reduces reliance on passwords and can improve privacy. The decision depends on how well teams can integrate them into existing authentication flows.
👉 Read our full editorial: Traditional MFA limits and continuous authentication for passwordless access
This post was modified 2 days ago by NHI Mgmt Group