What Is Multi-Factor Authentication?

Multi-factor authentication requires more than one distinct type of evidence to sign in. It is the single most effective control against credential theft, and its effectiveness now varies enormously depending on which factors are used.

The blanket claim that MFA stops account takeover was true when attackers were not routinely defeating it. It no longer is.

Not all factors resist the same attacks

Messages to a phone number are the weakest common factor, vulnerable to number porting and interception, and relayable in real time. They remain considerably better than nothing.

Authenticator application codes remove the telecommunications weakness and are still relayable: a user entering a code on a convincing fake site hands it to an attacker who uses it immediately.

Push approvals are convenient and vulnerable to fatigue — repeated prompts until someone approves one to make them stop. Number matching addresses much of this.

Hardware keys and passkeys are bound to the origin. The response is cryptographically specific to the site requesting it, so a fake site receives nothing usable. These are the only factors that genuinely resist phishing.

Coverage matters more than strength

An organisation with hardware keys on ninety per cent of accounts and passwords alone on the rest is protected at the level of the remainder, because attackers will find them. The gaps are predictable: service accounts, legacy protocols, break-glass accounts, contractors and applications that do not support modern authentication.

Legacy authentication protocols deserve particular attention. They bypass conditional access entirely, they are used routinely by attackers because they work, and disabling them tenant-wide is usually the single highest-value identity change available.

Rollout sequencing that survives contact with users

The predictable failure is enabling MFA broadly on a single date, generating a surge of lockouts and support calls, and granting exemptions under pressure that then become permanent.

What works is sequencing by risk and by population. Administrators first, because their compromise is most consequential and they are the most capable of handling enrolment. Then remote access, then general staff, then the awkward cases — shared devices, clinical workstations, field workers without reliable connectivity.

Enrolment should happen before enforcement, so the deadline is reached with most users already registered rather than simultaneously attempting it.

Shared and clinical environments need design, not exemption

Where staff move between workstations continuously, per-session authentication imposes real cost — and the response of exempting those environments removes protection precisely where sensitive data is accessed.

The workable answers are proximity badges with a PIN, fast user switching with short lock timeouts, and session persistence tied to physical presence rather than to a long timer. These cost more than an exemption and they preserve both the control and the workflow.

The principle generalises: where MFA conflicts with how people work, the fix is a different factor rather than no factor.

Where to start

List every identity currently excluded from MFA and treat each as a finding with an owner and an expiry date. That list is where an attacker will go.

See MFA without delaying clinical work. GuardsArm delivers zero trust security.