Topic starter
16/04/2026 8:40 pm
TL;DR: MFA is widely deployed, but most organisations still rely on mixed coverage and legacy methods like SMS OTP, leaving meaningful exposure to phishing, MITM, and inconsistent enforcement, according to Descope. The real security question is whether authentication is resilient enough to withstand modern credential abuse, not whether a second factor exists.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “MFA Trends: Where Auth Is Heading”.
By the numbers:
- 94% of organisations have some form of customer MFA, according to Descope research.
- Only 10% of organisations offer MFA across all their applications, according to Descope research.
- 45% of organisations have deployed passkeys in at least one app, according to Descope research.
Key questions
Q: What breaks when MFA is used only at sign-in and not for privileged actions?
A: The main failure is stale trust.
Q: Why do SMS OTP and other legacy MFA methods create so much operational and security risk?
A: Legacy MFA creates risk because many methods were designed for a desktop era and now sit poorly in a mobile-first world.
Q: How do security teams decide when to require step-up authentication?
A: Use step-up when the action changes account risk, not just when the user is already signed in.
Practitioner guidance
- Inventory MFA coverage by application and journey Map where MFA is actually enforced, where it is optional, and where users can still authenticate without it across customer and workforce flows.
- Prioritise phishing-resistant methods for high-risk access Roll out passkeys and other phishing-resistant factors first where account takeover impact is highest, then phase out OTP dependence in the same journeys.
- Replace blanket challenges with risk-based step-up Use device trust, location, behaviour and session context to trigger additional verification only when risk changes materially.
Bottom line: MFA adoption can be widespread while meaningful parts of the application estate remain reachable through weaker or inconsistent authentication paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 6:51 pm
Coverage is not the same thing as control: An MFA programme can look mature while still leaving major application and journey gaps. Descope’s figures point to a patchwork state where broad adoption coexists with partial enforcement, which means the control boundary is organisationally inconsistent. Practitioners should treat coverage as a governance problem, not a deployment checkbox.
Patchwork MFA is a governance problem, not a feature gap: Organisations should expect pressure to move from factor presence to factor quality, especially where customer and workforce journeys share the same identity stack. Coverage maps, exception tracking and enforcement consistency will become more important than claiming MFA adoption in the abstract.
A question worth separating out:
Q: Should organisations replace traditional MFA with passkeys and adaptive controls?
A: For most programmes, yes for the primary path and no for everything else. Passkeys should become the preferred method where device support allows it, while adaptive controls decide when extra checks are needed. Traditional MFA can remain as fallback, but it should no longer be the default for every login.
👉 Read our full editorial: Mfa adoption is rising, but phishing-resistant coverage lags