Topic starter
12/06/2026 10:08 pm
TL;DR: Traditional MFA remains vulnerable to phishing, credential stuffing, push bombing, and man-in-the-middle attacks, even as CISA, NIST, and the White House push organisations toward phishing-resistant authentication, according to Axiad. The real issue is not whether MFA exists, but whether it resists modern identity attack paths.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Is Your MFA Broken?”.
By the numbers:
- PKI-based authentication typically accounts for 40% of use cases across non-browser and enterprise login scenarios.
- FIDO-based authentication accounts for approximately 60% of use cases, covering browser-based authentication and Windows workstations.
Key questions
Q: Why do traditional MFA methods fail against phishing attacks?
A: Traditional MFA fails because many methods still depend on a code, prompt, or approval that an attacker can intercept, relay, or coerce in real time.
Q: When should organisations replace legacy MFA with phishing-resistant MFA?
A: They should do it first for privileged accounts, remote access, and any workflow that attackers can target with phishing or adversary-in-the-middle attacks.
Q: How can security teams tell whether adaptive MFA is working properly?
A: Look for a lower challenge rate on routine sessions, a higher challenge rate on suspicious transactions, and stable or improved conversion.
Practitioner guidance
- Inventory phishing-exposed authentication paths Map which user groups, applications, and remote access flows still rely on SMS, OTP, push approvals, or other phishable MFA methods.
- Separate browser and non-browser control standards Use FIDO-style controls where origin-bound browser authentication is feasible, and certificate-backed authentication where workstation, RDP, VDI, or other non-browser access needs stronger device or user proof.
- Eliminate approval-only push dependence Treat push fatigue and prompt bombing as governance failures, not user mistakes.
Bottom line: Traditional MFA can still be bypassed when the attacker can intercept, replay, or fatigue the authentication step.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 12:43 am
Factor count is not the control objective: Traditional MFA programmes often measure adoption instead of resistance. That creates a false sense of assurance when the deployed factor can still be phished, relayed, or approved under pressure. The practitioner takeaway is that authentication governance has to test adversary resistance, not checkbox coverage.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What is the difference between certificate-based authentication and FIDO in practice?
A: Certificate-based authentication is strongest where device-bound trust and managed issuance are needed, while FIDO is often better where supported applications and user experience matter most. Many enterprises need both. The decision is less about which method is better overall and more about which one fits the access path, platform, and assurance requirement.
👉 Read our full editorial: Why traditional MFA still fails against phishing attacks
This post was modified 6 days ago by NHI Mgmt Group