When does multi-factor authentication still leave organisations exposed to account takeover?

Why This Matters for Security Teams

MFA reduces risk, but it does not end account takeover risk when the second factor can be intercepted, replayed, approved from the wrong context, or bypassed through recovery and enrollment paths. That is especially true when the real target is the identity workflow around the account, not the password itself. Current guidance suggests treating MFA as one layer inside a broader identity assurance program, not as a standalone control.

NHIMG research shows how identity compromise continues to drive real-world incidents, with the Ultimate Guide to NHIs — Why NHI Security Matters Now noting that NHIs outnumber human identities by 25x to 50x in modern enterprises. That scale matters because attackers often move from one compromised credential to another until they reach a session, recovery channel, or enrollment flow that trusts the wrong signal.

Security teams also underestimate how often MFA fails at the edges rather than at login. Recovery codes, help desk resets, device re-enrollment, and push fatigue all create pathways that are weaker than the primary factor. In practice, many security teams encounter account takeover only after a session is already established, rather than through intentional MFA testing.

How It Works in Practice

The practical question is not whether MFA exists, but whether the organisation can bind authentication to the right user, device, and context at the moment of access. Stronger implementations combine phishing-resistant factors, strict recovery controls, device posture checks, and session monitoring. NIST’s SP 800-53 Rev. 5 Security and Privacy Controls and ISO-based identity programs both support this layered approach, but the operational detail matters more than the label.

• Prefer phishing-resistant methods over SMS or voice where possible.
• Harden factor enrollment so a new device cannot be added through weak support workflows.
• Require step-up verification for password resets, recovery, and high-risk transactions.
• Monitor impossible travel, anomalous device change, and repeated MFA prompts as takeover indicators.
• Shorten session lifetimes so a stolen token does not remain useful for long.

For non-human identities, the same logic applies with even less tolerance for weak exceptions. The attack path often starts with a leaked secret or reused token, then moves into a service account, API key, or workload session. NHIMG data shows that 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage, which makes identity workflow hardening a practical necessity rather than a maturity exercise. For breach context, see the 52 NHI Breaches Analysis and the Meta AI Instagram Account Takeover report. These controls tend to break down when legacy SSO, outsourced help desks, or consumer-grade SMS recovery remain embedded in the critical path because the weakest recovery channel becomes the takeover channel.

Common Variations and Edge Cases

Tighter MFA often increases friction, support load, and user pushback, requiring organisations to balance stronger assurance against operational usability. The best choice is not always the most aggressive challenge flow; it is the one that matches the risk of the account and the failure modes of the environment.

There is no universal standard for this yet, but current guidance suggests several recurring edge cases. Consumer-facing accounts may need simpler recovery paths, while privileged admin accounts should use the strongest available phishing-resistant methods. Shared accounts, service desks, and outsourced operations are frequent weak points because they combine human exception handling with high-value access. In those environments, the issue is often not the factor itself but the trust granted to identity proofing, device replacement, or delegated support.

Security teams should also remember that MFA can fail after authentication if the session token is stolen, the device is compromised, or the attacker can approve prompts through social engineering. That is why many mature programs pair MFA with conditional access, token binding where available, and rapid revocation of active sessions after suspicious events. The gap between policy and enforcement is often where account takeover succeeds.

Related resources from NHI Mgmt Group

• Why do organisations still face account takeover risk even after deploying FIDO-based passkeys?
• Why do passwords and basic MFA still leave organisations open to account takeover?
• How do organisations know if their CI/CD environment is still exposed after an npm supply chain attack?
• Why do multi-factor and passwordless controls still fail when identity proofing is weak?