Multi-factor authentication is the single most cost-effective control most organizations can deploy. It also is not enough on its own. Understanding both sides of that statement is the difference between an identity strategy and a checkbox.
Why MFA is essential
The overwhelming majority of account compromises rely on stolen or guessed passwords. MFA breaks that chain by requiring something the attacker does not have — a device, a token, a biometric. Deployed well, it blocks the great mass of opportunistic attacks and dramatically shrinks what targeted attackers can do with a leaked credential.
Where attackers still get through
- MFA fatigue — bombarding a user with prompts until one is approved.
- Real-time phishing kits that relay the second factor to the attacker.
- SIM swapping when SMS is the second factor.
- Session-token theft that bypasses login entirely.
- Legacy protocols and app passwords that never triggered MFA in the first place.
What layered identity defense looks like
- Phishing-resistant factors (FIDO2 keys, platform authenticators) for administrators and high-risk roles.
- Number-matching and geographic/behavior signals to defeat fatigue attacks.
- Conditional access policies that require managed devices for sensitive apps.
- Legacy authentication disabled and audited.
- Session monitoring that revokes tokens on anomalous behavior.
Common misstep
Turning on MFA but leaving legacy protocols enabled is the most frequent gap we find. Attackers pivot to whichever door is unlocked.
Summary
Deploy MFA everywhere; then treat it as the floor, not the ceiling. Layer phishing-resistant factors, conditional access, and session controls on top for the accounts that would hurt the most if lost.