Topic starter
07/03/2026 1:07 am
TL;DR: Traditional MFA still depends on passwords, shared secrets, or weak out-of-band factors, leaving phishing, SIM swap, and push fatigue paths open, according to Beyond Identity. For IAM and NHI governance, the practical shift is toward passwordless authentication, device-bound assurance, and continuous policy checks rather than stronger add-ons to a flawed login stack.
Editorial analysis by NHI Mgmt Group, based on content published by Beyond Identity: “Can Passwordless Authentication Replace My MFA?”.
Key questions
Q: What breaks when MFA is used only at sign-in and not for privileged actions?
A: The main failure is stale trust.
Q: Why does SMS-based MFA still create account takeover risk?
A: SMS creates risk because the factor travels through a channel that can be redirected through SIM swapping, message interception, or social engineering.
A: Organisations should treat passwordless authentication as an access-control redesign, not a cosmetic login change.
Practitioner guidance
- Remove password fallbacks from priority access flows Identify the applications and admin pathways where password reset or password-based fallback still exists, then remove those paths first so a stolen secret cannot become the default recovery route.
- Replace SMS and email OTPs with device-bound assurance Retire out-of-band codes for high-value access and require device possession plus local verification on the endpoint, especially where phishing and SIM swap are realistic threats.
- Enforce device posture checks at login Require the access decision to evaluate endpoint posture such as encryption, secure enclave support, and managed security tooling before granting the session.
Bottom line: Traditional MFA still leaves a reusable secret in the access path, which preserves the attack surface for phishing, reuse, and account takeover.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
08/10/2026 4:58 pm
Passwords in the MFA chain are not a secondary weakness, they are the primary assumption failure. Traditional MFA assumes a compromised password can be rescued by a stronger second factor. In practice, that makes the second factor carry the entire burden of assurance, which is an unstable foundation for both human and non-human access. The practitioner takeaway is that password removal is a control decision, not a user-experience preference.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What signals show that MFA is no longer strong enough for the programme?
A: Frequent push approvals, heavy reliance on SMS or email codes, password reset dependency, and repeated user complaints about friction all indicate that the programme is leaning on brittle factors. Those symptoms mean authentication is still built around shared secrets, not durable identity assurance.
👉 Read our full editorial: Passwordless authentication and MFA: what changes for NHI governance