How should security teams choose between hardware and software tokens for MFA?

Security teams should choose based on assurance needs, user mobility, and recovery complexity. Hardware tokens are better where phishing resistance and impersonation resistance matter most. Software tokens are better when endpoint integration and user convenience are important, but they must be bound to a trusted device model and governed through strong lifecycle controls.