MFA Is Not Enough Anymore: What IT Leaders Need to Know in 2026
For years, the advice was simple: turn on multi-factor authentication and you’re in good shape. MFA stopped the vast majority of credential-based attacks. It was cheap to deploy, easy to explain to leadership, and it worked.
That era is not over. MFA still matters. But if you think turning on MFA and calling it done is enough in 2026, you’re behind. Attackers have spent the last several years figuring out how to get around it, and they’re getting very good at it.
This article breaks down exactly what’s happening, why standard MFA is no longer a complete answer, and what IT Directors and CIOs should actually be doing about it.
What Changed: How Attackers Got Around MFA
Multi-factor authentication works by adding a second step to the login process. Even if an attacker steals your password, they still need that second factor. For most of its history, that was enough to stop most attacks.
The problem is that most MFA deployments rely on methods that can be bypassed. Here are the main techniques attackers are using today.
MFA fatigue attacks. Also called push bombing. The attacker has your username and password. They trigger dozens of MFA push notifications to your phone, back to back. Most people, after the 10th or 15th notification in a row, just tap “Approve” to make it stop. It only has to work once. This is how Uber and Cisco were breached in 2022, and it’s become one of the most common attack patterns since then.
Adversary-in-the-middle phishing. This is a more technical version of the same problem. The attacker sets up a fake login page that looks exactly like your Microsoft or Google login. When you enter your credentials and MFA code, the fake site passes them to the real site in real time, capturing a live session token. The attacker now has your session cookie and does not need your password or MFA code again. They’re already logged in.
SIM swapping. Attackers call your mobile carrier, impersonate you, and convince a rep to transfer your phone number to a SIM card they control. Once they have your number, they receive all your SMS verification codes. This works against any MFA method that sends codes via text message.
Session token theft. Modern attacks often target the session token rather than the login itself. Malware like infostealers can pull saved session cookies from your browser. Once an attacker has a valid session token, they can access your accounts without ever going through MFA.
The pattern across all of these is the same: standard MFA still relies on something that can be intercepted, stolen, or socially engineered. The second factor is no longer as hard to get around as it used to be.
Which MFA Methods Are Actually Vulnerable
Not all MFA is the same. Some methods are far more vulnerable than others.
SMS-based codes are the weakest form of MFA still in wide use. They’re vulnerable to SIM swapping, SS7 protocol attacks, and social engineering. If you still have employees logging in with codes sent by text message, that is worth fixing.
Email-based codes have similar problems. If an attacker compromises the email account, they can receive the verification code there.
Push notifications are more convenient than codes but vulnerable to MFA fatigue attacks. Most push apps now offer number matching, which requires the user to enter a specific number shown on the login screen rather than just tapping approve. That closes most of the fatigue attack surface. If you use push-based MFA and have not enabled number matching, that is a quick win.
TOTP apps (like Google Authenticator or Microsoft Authenticator in code mode) are better than SMS but still vulnerable to real-time phishing. The attacker captures the code as you type it and uses it immediately.
Hardware security keys and passkeys are the strongest options available today. They are covered in more detail below.
What Phishing-Resistant MFA Actually Means
The term “phishing-resistant MFA” gets thrown around a lot. Here’s what it actually means.
Standard MFA asks you to prove you have something (a phone, an app, a code). Phishing-resistant MFA goes a step further. It cryptographically binds the authentication to the specific website or application you’re logging into. That means even if an attacker tricks you into authenticating on a fake site, the credential cannot be used anywhere else.
There are two main forms:
FIDO2 hardware security keys. Physical devices, like a YubiKey, that plug into a USB port or tap over NFC. The key generates a cryptographic proof that is tied to the specific site’s domain. It cannot be replayed or intercepted because the authentication only works for the exact site the key was registered with. These are the gold standard for high-risk users.
Passkeys. A newer, more user-friendly implementation of the same FIDO2 standard. Instead of a physical key, your device (phone, laptop) acts as the authenticator using biometrics like Face ID or fingerprint. Passkeys are built into Apple, Google, and Microsoft platforms now. They offer the same phishing resistance as hardware keys with much less friction.
Both options eliminate the categories of attack that currently threaten standard MFA. If an attacker tries to use a fake login page, the credential simply does not work on any other domain.
What Zero Trust Has to Do With This
Zero trust is a security model, not a product. The core idea is that you do not automatically trust any user, device, or network just because they passed authentication. Trust is evaluated continuously, for every request.
MFA is one layer in a zero trust model, but it is not the whole thing.
Conditional access policies are where zero trust thinking gets applied in practice. Instead of saying “if you pass MFA, you’re in,” conditional access says things like:
- If you’re logging in from an unmanaged device, you can read email but not download attachments.
- If you’re in a new location we haven’t seen before, require additional verification.
- If your device doesn’t meet our compliance requirements, block access entirely.
Microsoft Entra ID, Okta, Google Workspace, and most modern identity platforms support conditional access policies. If you are not using them, you are leaving a significant layer of protection on the table.
The combination of phishing-resistant MFA plus conditional access policies is what actually moves the needle on identity security in 2026.
A Practical Roadmap for IT Leaders
You do not need to rip out your entire identity infrastructure. Here is a staged approach that gets you to a much stronger security posture without a massive project.
Step 1: Turn off SMS-based MFA wherever possible. This is the lowest-hanging fruit. If you’re still using SMS codes as your second factor for corporate accounts, replace it with an authenticator app at minimum.
Step 2: Enable number matching for push notifications. If you use Microsoft Authenticator or a similar push-based MFA app, turn on number matching now. Most vendors have made this the default, but if you have older configurations, check. This closes the MFA fatigue attack vector with almost no user friction.
Step 3: Identify your highest-risk users and roles. Not everyone needs a hardware security key. But your IT admins, finance team, executives, and anyone with access to sensitive data or privileged accounts should be on your shortlist for phishing-resistant MFA. Start there.
Step 4: Pilot passkeys or hardware keys for that high-risk group. Passkeys have improved dramatically in the last 18 months. For most organizations, they are now the easiest path to phishing-resistant MFA for end users. Hardware keys are still the right call for very high-risk admin accounts.
Step 5: Build or review your conditional access policies. Work through what different access scenarios look like in your environment. Managed vs. unmanaged devices, trusted locations vs. unknown locations, high-sensitivity applications vs. low-sensitivity ones. Build policies that match your actual risk profile.
Step 6: Audit your session management settings. Look at how long sessions stay active across your key applications. Shorter session lifetimes reduce the window of exposure if a token is stolen.
What to Tell Leadership
If you need to make the case for upgrading your MFA posture, here is the short version.
The attacks that are working against organizations right now are not brute-force password attacks. They are attacks that specifically target MFA. The defenses that were good enough three years ago have a known bypass. Upgrading to phishing-resistant MFA closes that bypass. The cost is low. The risk reduction is real.
Cyber insurers are also paying attention. Some are now asking about phishing-resistant MFA as part of underwriting. That conversation is coming if it has not reached you yet.
The Bottom Line
MFA is still better than no MFA. That has not changed. But “we have MFA” is no longer a complete answer to the question of how your organization handles authentication security.
The good news is that better options exist, they work, and they are not that hard to deploy. Phishing-resistant MFA through passkeys or hardware keys is available today from every major identity platform. Conditional access policies let you apply smart rules around every login attempt.
The threat has evolved. Your defenses need to catch up.
Catch Advisors helps IT leaders at mid-market companies build security programs that match their real risk profile, without overspending or overcomplicating. If you want a second opinion on your identity security posture, visit catchadvisors.com to start the conversation.