MFA Adoption Statistics: Usage, Phishing Resistance and Coverage Gaps

Multi-factor authentication is the most cited identity control in security advice, yet the best primary data shows that a large share of organisations and users still sign in without it, and only a small minority use phishing-resistant methods. This page collects adoption and effectiveness figures from primary publishers only: the UK government's Cyber Security Breaches Survey, Microsoft's own research and Digital Defense Reports, Okta's Secure Sign-in Trends Report, the FIDO Alliance Passkey Index and the Verizon Data Breach Investigations Report. Every figure carries its publisher, report and as-of year, and the methodology limits that change how each number should be read. It is written for security leaders who need defensible numbers for a business case and for practitioners who want to know where their own coverage sits against the field. For attack volumes and techniques, see the Identity Attack Statistics Guide, which this page does not repeat.

Last reviewed: November 2026.

Key takeaways

• Organisation-level adoption is still low outside large enterprises. Only 40% of UK businesses and 35% of UK charities reported two-factor authentication for networks or applications in the Cyber Security Breaches Survey 2025.
• User-level adoption has plateaued around seven in ten. Okta reported 70% workforce MFA adoption among its customers' users in January 2025, with wide gaps by industry, from 87% in technology to 42% in transportation and warehousing.
• Phishing-resistant MFA is a minority method. Phishing-resistant authenticators rose from 8.6% to 14.0% of Okta workforce users in a year, while 15.3% still used SMS and 93.0% still used a password somewhere.
• The effectiveness evidence is strong but specific. Microsoft research published in 2023 found MFA reduced the risk of account compromise by 99.22%, and by 98.56% for accounts with leaked credentials. The widely quoted 99.9% figure comes from a 2019 Microsoft blog with no published methodology.
• Passkeys change the usability argument. The FIDO Alliance Passkey Index (October 2025) reported a 93% sign-in success rate for passkeys against 63% for other methods, and 8.5 seconds per sign-in against 31.2 seconds for traditional MFA.

How organisations report MFA adoption

Organisation-level surveys ask whether a control is in place at all. They tell you nothing about coverage within an organisation, but they are the best guide to the long tail of small businesses and charities that vendor telemetry does not see.

• Reading the gap: in the 2025 UK survey, nearly twice as many businesses had a password policy as had two-factor authentication. Password rules remain the default identity control for most small organisations, which is the population most exposed to credential stuffing and password spraying (ATT&CK T1110.003).
• What "in place" means: the survey records whether two-factor authentication is used for networks or applications. An organisation that protects email but not its VPN, or its staff but not its administrators, still answers yes. Treat the figure as a ceiling on full coverage, not a measure of it.
• Use for benchmarking: if you advise or supply small organisations, this survey is the most defensible public baseline. It is repeated annually by the UK Department for Science, Innovation and Technology, so the figure can be refreshed each spring.

How many users actually sign in with MFA

Vendor telemetry measures what users do rather than what administrators report. Okta's Secure Sign-in Trends Report 2025 defines an adoption rate as the share of users who signed in with a given authenticator over a month, using anonymised workforce data and excluding customer identity and regulated environments. Prior-year figures were restated to the new method, so compare only within the same edition.

• Size runs against intuition: Okta reports that adoption generally falls as organisation size grows. Larger estates carry more legacy applications, frontline and shift workers, shared devices and exceptions, and each exception is a user who never presents a second factor.
• Frontline sectors lag: the lowest figures sit in sectors with deskless workforces, where staff often lack a corporate phone and share kiosks. These are exactly the populations where FIDO2 security keys or device-bound passkeys remove the dependency on a personal phone.
• Selection bias: these are customers of a cloud identity provider who have already centralised sign-in. The wider population, including organisations still running on-premises directories without a modern identity provider, is likely to be lower. That is an inference, not a published figure.

Phishing-resistant MFA, SMS and passwords

Adoption headlines treat all second factors as equal. The method mix matters more, because one-time codes and push approvals can be relayed or socially engineered (T1111 Multi-Factor Authentication Interception, T1621 Multi-Factor Authentication Request Generation), while FIDO2 and WebAuthn bind the credential to the genuine site.

• The ceiling case: Microsoft's Secure Future Initiative progress report of November 2025 states that it enforces phishing-resistant MFA for 99.6% of Microsoft employees and devices. That shows near-complete coverage is achievable in a very large estate, but it took a multi-year, company-wide programme.
• Government position: CISA describes phishing-resistant MFA as "the standard all industry leaders should strive for" and states that the only widely available phishing-resistant authentication is FIDO/WebAuthn. It also states that any MFA is better than no MFA and recommends number matching where phishing-resistant methods are not yet possible.
• Passwords persist: with 93% of users still entering a password somewhere, the password remains part of the attack surface even where MFA is enforced, because it feeds spraying, phishing kits and self-service recovery flows.

See the Phishing-Resistant MFA Guide for the methods and rollout, and the Passwordless and Passkeys Guide for the passkey model.

How effective MFA is: the evidence behind the 99% figures

• Why MFA scores so high: the Digital Defense Report 2024 places under 1% of identity attacks in the classes that target MFA itself (SIM swapping, MFA fatigue, adversary-in-the-middle) or bypass it after sign-in (token theft, consent phishing). Blocking the password-only route removes the bulk of volume.
• Why it is not the whole answer: the residual 1% is where skilled attackers operate. Session cookie theft (T1539) and push fatigue defeat weaker MFA, which is the reason phishing-resistant methods and token protection matter for high-value users. See the MFA Fatigue and Bypass Guide.
• Credential abuse is still the top entry route: the Verizon 2025 Data Breach Investigations Report, covering 12,195 confirmed breaches, found credential abuse was the initial access vector in 22% of breaches, ahead of vulnerability exploitation at 20%.

Passkeys and the usability case

The main objection to stronger MFA has always been friction. The FIDO Alliance Passkey Index (October 2025), compiled with Liminal from confidential data supplied by nine member organisations that had run passkeys for one to three years (Amazon, Google, LY Corporation, Mercari, Microsoft, NTT DOCOMO, PayPal, Target and TikTok), gives the best public evidence that passkeys reduce friction rather than add it.

• Scope limit: these are large consumer-facing services, so the figures describe customer sign-in more than workforce sign-in. They are still the strongest public evidence for the business case of moving workforce users off codes and push.
• Enrolment gap: 93% eligibility but 36% enrolment shows that availability is not adoption. Workforce programmes face the same gap and close it with enforced registration campaigns and conditional access, not by waiting for voluntary uptake.

Coverage gaps the headline numbers miss

• Legacy and non-interactive protocols: an adoption rate counts users who used MFA in a month, not sign-ins that could bypass it. IMAP, POP, SMTP AUTH and other legacy authentication paths accept a password alone unless blocked.
• Remote access appliances: the Change Healthcare breach began with a stolen credential on a Citrix remote-access portal that did not require MFA, in an organisation that would almost certainly have reported MFA as "in place" elsewhere.
• Third-party and SaaS tenants: in the Snowflake customer breaches, Mandiant found the affected accounts had no MFA, so infostealer-harvested usernames and passwords were enough. SaaS platforms outside the central identity provider are rarely counted in adoption metrics.
• Machine identities: service accounts, API keys and tokens cannot complete an interactive second factor at all. They are excluded from every adoption statistic on this page and need different controls. See the Service Account Security Guide.
• Recovery flows: an account protected by a passkey but recoverable through SMS or a help desk call is only as strong as the recovery path. See the MFA backup codes and recovery codes guide.

What the numbers mean for defenders

Suggested internal metrics to set beside these benchmarks: percentage of workforce users with a registered phishing-resistant method; percentage of sign-ins (not users) completed with MFA; percentage of privileged accounts on phishing-resistant MFA (target 100%); number of applications or protocols that accept password-only sign-in; count of active MFA exclusions with an owner and expiry date; and share of help desk tickets caused by sign-in failures, before and after passkey rollout.

Practitioner checklist

• Cite the 2023 Microsoft research figure (99.22%) rather than the 2019 99.9% blog figure in board papers, and state what it measures.
• Report MFA as coverage of sign-ins and applications, not as "enabled", so legacy protocols and appliances appear in the number.
• Benchmark user adoption against the Okta figure for your size band and industry, and explain any gap.
• Put every administrator and every remote access path on phishing-resistant MFA before widening the rollout.
• Block legacy authentication protocols that accept a password alone, and verify with sign-in logs.
• Inventory SaaS tenants and third-party portals outside the identity provider and require MFA or federation for each.
• Set a dated plan to retire SMS for privileged and high-risk roles, using number matching as the interim control.
• Track passkey enrolment against eligibility; enrolment, not availability, is the measure.
• Refresh this benchmark set each year when the UK survey, Okta report and FIDO index are republished.

Standards and references

• UK Department for Science, Innovation and Technology: Cyber Security Breaches Survey 2025
• Microsoft (Meyer et al.): How effective is multifactor authentication at deterring cyberattacks?
• Microsoft: Digital Defense Report 2024
• Okta: The Secure Sign-in Trends Report 2025
• FIDO Alliance: Passkey Index
• CISA: Multifactor Authentication
• Verizon: 2025 Data Breach Investigations Report
• Microsoft: Secure Future Initiative progress report, November 2025

Related NHI Mgmt Group resources: Identity Attack Statistics Guide · MFA Guide · Phishing-Resistant MFA Guide · Top 10 MFA Mistakes · Azure Mandatory MFA