Know
What is Multi-Factor Authentication?
MFA combines factors such as something you know, something you have, or something you are. The security value depends heavily on the method: phishing-resistant authenticators such as properly deployed FIDO/WebAuthn credentials provide stronger protection against modern phishing than approval prompts or one-time codes.
Why it matters
Stolen passwords are common. MFA can stop an attacker who has a password from immediately becoming the legitimate user, although weaker MFA methods can still be phished, intercepted, or abused.
Evidence, not hype
Validated in the real world
Every record is labeled by evidence type and source strength so an incident, a standard, and emerging research are never presented as if they are the same thing.
Scattered Spider targeted enterprise help desks and identity controls
A joint advisory describes Scattered Spider tactics obtained through investigations, including targeting IT help desks, social engineering, identity abuse, and the need for phishing-resistant MFA.
The advisory validates how modern intrusions can begin with human and identity-control failures and maps observed behavior to MITRE ATT&CK techniques.
CISA red team gained persistent access while MFA blocked access to a sensitive system
During a CISA red-team assessment, the team gained persistent network access and moved laterally, but MFA prompts prevented access to one sensitive business system. CISA also recommended EDR, modern identity practices, centralized cybersecurity data, and Zero Trust architecture.
This controlled assessment shows both the failure modes of incomplete monitoring and the practical defensive value of MFA, endpoint visibility, identity controls, and modern architecture.
Understand the mechanics
How it works
- 1
The user presents a primary authentication factor.
- 2
The service requests an additional factor from a different category.
- 3
The verifier validates the authentication evidence.
- 4
Policy may add device, location, or risk conditions before access is granted.
Practice
What to watch for
- Unexpected MFA prompts
- Prompts from unfamiliar locations or devices
- Requests to share an OTP
- Calls claiming IT needs an approval
- New authenticator enrollment you did not initiate
Perform
What to do
- 1
Deny unexpected authentication requests.
- 2
Do not share one-time codes.
- 3
Change the password if compromise is suspected.
- 4
Report unexpected prompts or authenticator changes.
How to reduce the risk
- Prefer phishing-resistant authentication
- Require MFA for privileged and remote access
- Protect enrollment and recovery
- Use conditional access
- Monitor unusual authentication behavior
Business impact
- Reduced account takeover risk
- Protection of privileged access
- Reduced impact of password theft
- Potential support/recovery risk if enrollment is weak
What different roles should do
Employee
- Approve only authentication you initiated
- Protect recovery methods
IT
- Prefer phishing-resistant MFA
- Harden enrollment and reset processes
Framework & standards context
- NIST SP 800-63B — Authentication and Authenticator Management
Source transparency
Authoritative sources
Last reviewed: 2026-09-02