Topic starter
16/01/2026 5:11 pm
TL;DR: MFA fatigue attacks use repeated prompts, impersonation, and urgency to pressure users into approving unauthorized access. StrongDM’s article highlights real breaches at Cisco, Uber, and Microsoft, and notes that even a small approval rate can make accounts vulnerable. Prompt-based MFA needs stronger controls, not just more notifications.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “MFA Fatigue Attack: Meaning, Types, Examples, and More”.
Key questions
Q: What breaks when users can be bombarded into approving MFA prompts?
A: The control breaks when approval is treated as proof of intent.
Q: Why do privileged accounts make MFA fatigue more dangerous?
A: Privileged accounts make MFA fatigue more dangerous because one successful approval can expose cloud consoles, admin tools, source repositories, and other sensitive systems.
Q: What signals show that an MFA fatigue attack is underway?
A: Look for repeated MFA requests in a short period, a long series of denials, and then one unexpected approval.
Practitioner guidance
- Tighten MFA challenge thresholds Limit repeated prompts, shorten approval windows where appropriate, and block high-frequency challenge loops that train users to approve reflexively.
- Reduce standing privilege on approved sessions Pair authentication with least privilege, narrow session scope, and separate privileged workflows so one approved prompt does not open broad admin access.
- Require stronger verification for high-risk access Use hardware-backed factors, contextual checks, or biometric requirements for accounts that can reach cloud consoles, security tooling, or domain administration.
Bottom line: MFA fatigue attacks succeed by exhausting the user’s willingness to reject repeated prompts, which makes approval behaviour part of the attack surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 9:41 pm
Prompt-based MFA is a human behaviour control, not a complete identity control. If the user can be conditioned to approve, the authentication event itself becomes an attacker surface. That means the control assumption is weaker than many IAM programmes admit, because the system depends on sustained user vigilance at the exact moment an attacker is trying to erode it. The practitioner conclusion is that approval flow design matters as much as factor strength.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: When should organisations move beyond MFA to device-bound authentication?
A: Organisations should move beyond MFA when users access high-value systems from unmanaged, remote, or adversarial networks, or when the threat model includes local trust-store tampering. MFA helps at the point of login, but device-bound authentication adds assurance that the credential itself is tied to known hardware and a monitored device state.
👉 Read our full editorial: MFA fatigue attacks expose the limits of prompt-based authentication