Make It Harder to Take Over: Is Your MFA Actually Protecting You?

Multi-factor authentication (MFA) is often considered one of the most effective tools in our collective cybersecurity arsenal. Whether you are logging into your personal email or accessing work accounts, an extra verification step beyond a standard username and password drastically reduces the likelihood of unauthorized access.

Its effectiveness is well-established: according to Microsoft’s 2025 Digital Defense Report, implementing modern MFA reduces the risk of identity compromise by more than 99%. However, as MFA adoption has grown, so has the sophistication of cyber threats. Attackers have adapted, increasingly shifting away from brute-forcing passwords to actively exploiting weaknesses in authentication processes, workflows, and more.

Having MFA enabled is no longer the finish line – it is the baseline. This Cybersecurity Awareness Month (and every month!), the IT-ISAC is encouraging organizations and individuals to Make It Harder for Attackers by strengthening the foundation of their login authentication practices, while closing the security gaps that modern adversaries seek to exploit.

The Fundamentals: Strengthening Account Security with MFA

At its core, MFA requires two or more distinct verification factors before granting access to an account or application. These factors are traditionally categorized under three umbrellas:

• Something You Know: Knowledge-based credentials, such as a password, PIN, or passphrase.

• Something You Have: An extra physical measure, such as a hardware security key, an authenticator app generating one-time passwords (OTP), or a trusted mobile device.

• Something You Are: Biometric data, including facial recognition, fingerprint scans, or iris matching.
  

While combining "something you know" with "something you have" or "something you are" creates a strong first line of defense, implementation must be consistent across the entire enterprise for these fundamentals to succeed. Building this consistency begins with making MFA mandatory across all points of entry, including corporate email, cloud environments, collaboration tools, remote access solutions, and administrative accounts. Organizations should also focus on upgrading verification methods and transitioning away from legacy mechanisms like SMS or voice calls — which are vulnerable to interception — in favor of authenticator apps, passkeys, and FIDO2-certified security keys.

Equally important is empowering your team to recognize modern exploitation tactics. Employees should be trained to treat unsolicited authentication prompts as immediate red flags; never approve unexpected requests, and report spam attempts immediately. At the same time, security teams must work to harden their organization’s account enrollment and password recovery lifecycle. Because attackers frequently exploit help desk reset requests, organizations need to secure backup codes, enforce strict identity verification standards for these resets, and train support staff against the pitfalls of social engineering.

Beyond the Fundamentals: Evolving Authentication Threats

Basic MFA coverage is not always enough. Modern attackers utilize sophisticated techniques – such as bombing MFA requests, adversary-in-the-middle (AiTM) phishing with reverse-proxy servers, session token theft, and fraudulent recovery requests — to bypass standard checks.

To stay ahead, security teams should prioritize four critical safeguards:

1. Phishing-Resistant Authentication Traditional MFA methods, including SMS codes and push notifications, can still be intercepted or phished using reverse-proxy methods. Phishing-resistant tools, such as FIDO2 security keys and WebAuthn-based passkeys, use domain-bound public key cryptography. This ensures credentials cannot be entered into a fake login portal, making credential phishing virtually impossible.

2. Defense Against MFA Bypass and Session Hijacking Rather than cracking MFA, cybercriminals often bypass it entirely by stealing post-authentication session tokens using infostealer malware. Additionally, "MFA fatigue" attacks bombard users with continuous push notifications until they approve access out of frustration. To stop these attacks, enable number matching for push notifications so users can’t approve a login without manually confirming the right sender. Smart login rules also automatically block access if a request comes from an untrusted device, an unknown location, or an unsafe network. Finally, lock session tokens directly to the user’s device so stolen login cookies can’t be used on an attacker’s computer. 

3. Close Authentication and Recovery Gaps Attackers routinely seek out paths of least resistance. Instead of trying to break through strong MFA defenses, they often look for hidden backdoors — such as outdated systems that don't support extra login steps, forgotten test servers, unmonitored automated accounts, or helpful helpdesk staff who can be tricked into resetting a password. To close these gaps, regularly audit your network to retire old login systems, strictly limit what automated software and key codes can access, and closely monitor third-party vendor connections.

4. Monitor Authentication Activity and Strengthen Response Enforcing MFA enrollment is only half the battle; security teams must monitor the authentication process continuously. Here are some ways to tell if you’ve been compromised:

• Spikes in denied MFA requests or unexpected device registrations.

• "Impossible travel" sign-in events or speed logins across distant locations.

• Sudden changes to account security settings or recovery methods

If an attacker gets in, revoke access as quickly as possible, reset compromised credentials, and isolate any affected accounts.

Questions Defenders Should Be Asking

As your organization evaluates its current MFA implementation, we recommend asking these questions:

1. Are we using the strongest MFA methods available? Have we prioritized phishing-resistant authentication (FIDO2/passkeys) for high-risk, privileged, and cloud administrative accounts?
   

2. Can attackers bypass our current MFA controls? Have we implemented number matching, session monitoring, and conditional access to mitigate MFA fatigue and session hijacking?
   

3. Where are our hidden authentication gaps? Are legacy systems, unmonitored API keys, service accounts, or weak helpdesk verification steps creating backdoors into our environment?
   

4. Can we detect and respond to authentication anomalies quickly? Do we monitor real-time authentication logs, and can our analysts immediately terminate compromised sessions?
   

Make It Harder for Attackers: The Power of Collective Defense

Even the most advanced authentication methods shouldn't have to protect your environment alone. Identity security works best when implemented consistently and reinforced as part of a layered, multi-tier defense strategy.

That interconnected reality brings us to the core of this week’s Cybersecurity Awareness Month message: protecting the broader technology sector. In our interconnected world, compromised credentials at a single organization can quickly expose customer platforms, supply chains, and trusted third-party networks. Reviewing your MFA policies, eliminating legacy authentication backdoors, and transitioning toward phishing-resistant standards isn't just an internal IT task. It is vital to safeguarding the IT sector as a whole.

Next week’s Cybersecurity Awareness Month focus area is phishing. Since modern attackers frequently use deceptive emails and fake login pages to bypass authentication entirely, we’ll dive deep into how to recognize, defend against, and report sophisticated phishing threats. Be sure to check back for our third blog post in the series!

Lastly, defenders don't have to tackle these evolving threats in isolation. Attackers routinely share tools, techniques, and stolen access — which is why defenders must share actionable intelligence with each other. By sharing threat indicators, suspicious activity patterns, and defensive lessons learned through trusted networks like the IT-ISAC, we help the entire sector stay ahead of threat actors and become more secure.