Topic starter
16/01/2026 4:52 pm
TL;DR: Push bombing, also known as MFA fatigue, uses repeated authentication prompts to push users into approving access, and Beyond Identity cites breaches at Uber and Cisco plus ransomware groups such as Scattered Spider as evidence that legacy push-based MFA remains exploitable. Static approval prompts are no longer a reliable control when attackers can weaponize user attention and urgency.
Editorial analysis by NHI Mgmt Group, based on content published by Beyond Identity: “What Is Push Bombing? And How Beyond Identity Makes It Impossible”.
Key questions
Q: What breaks when push-based MFA is the main control for privileged access?
A: Push-based MFA breaks down when attackers can flood users with prompts or impersonate support staff into approving one.
Q: Why do repeated MFA prompts increase breach risk instead of proving stronger security?
A: Repeated prompts increase risk because they create fatigue, normalise approval behaviour, and turn authentication into a pressure test.
Q: How can security teams tell whether adaptive MFA is working properly?
A: Look for a lower challenge rate on routine sessions, a higher challenge rate on suspicious transactions, and stable or improved conversion.
Practitioner guidance
- Review push-based MFA exposure Identify where approval prompts still act as the decisive factor for privileged and high-risk access, then classify those flows as susceptible to MFA fatigue abuse.
- Reduce reliance on repeated user approval Replace notification-driven approval workflows with authentication methods that do not ask users to confirm each login attempt under pressure.
- Prioritise high-impact accounts first Start with accounts whose compromise would create the largest blast radius, including admins, support staff, and access paths into sensitive systems.
Bottom line: Push bombing works because it targets the approval step in legacy MFA rather than trying to defeat the first factor directly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:57 pm
Approval-by-prompt is the broken control assumption. Push bombing succeeds because legacy MFA often assumes the user can remain a reliable security gate after repeated interruption. That assumption is fragile even before the attacker applies pressure, and it collapses completely when the request stream is designed to exhaust judgment. The implication is that identity teams should stop treating user approval as a stable trust boundary.
A question worth separating out:
Q: Should organisations replace MFA with passwordless authentication?
A: Organisations should not treat this as a simple replacement question. MFA is still useful where passwordless is not yet available, but passwordless raises the security baseline by removing the password as the primary failure point. The right path is to use MFA as a bridge and passwordless as the destination.
👉 Read our full editorial: Push bombing exposes the weakness in legacy MFA controls