# How to Choose an MFA Solution

Source: https://startwithidentity.com/guides/buyer-guides/how-to-choose-an-mfa-solution/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Not all multi-factor authentication is equal. The goal in 2026 is **phishing-resistant** [MFA](https://startwithidentity.com/vendors/mfa/), not just any second factor.

## 1. Prioritize phishing resistance

SMS and basic OTP are better than nothing but are phishable and vulnerable to SIM swaps. Favor FIDO2 security keys and [passkeys](https://startwithidentity.com/guides/authentication/passkeys-101/), which resist phishing by design. Our [research](https://startwithidentity.com/research/) shows phishing-resistant MFA blocks the overwhelming majority of identity attacks.

## 2. Cover your whole estate

Modern web apps are easy. The hard parts are VPNs, legacy apps, desktop login, and [service accounts](https://startwithidentity.com/guides/fundamentals/what-is-non-human-identity/). Confirm coverage where you actually need it.

## 3. Mind enrollment and recovery

Most real-world MFA bypasses target weak enrollment and account recovery, not the factor itself. Evaluate how a vendor handles onboarding and reset.

## 4. Fit your stack

If you already run a major [IAM](https://startwithidentity.com/vendors/iam/) platform, its built-in MFA may suffice. Standalone specialists shine for workforce passwordless and broad coverage.

## 5. Name the method class in your policy

A policy that says "require MFA" is satisfied by methods that commodity phishing kits defeat every day. The Mirage2FA campaign reached 4,532 organization domains between 2024 and 2026 without breaking a single factor: it captured the password and the resulting session cookie through legitimate Microsoft 365 login flows and rode the authenticated session.

Write policy against the property, not the acronym. [Phishing-resistant](https://startwithidentity.com/glossary/phishing-resistant-mfa/) means origin-bound: the authenticator refuses to sign for a domain other than the one that registered the credential. Anything a human can read, type, or approve can be relayed.

## 6. Ask what the vendor does about session theft

MFA at the door does not help if the attacker arrives holding a session that already authenticated. Ask specifically about token binding or device-bound sessions, session revocation APIs, and continuous evaluation, because [token theft](https://startwithidentity.com/glossary/token-theft/) is now the dominant bypass rather than factor compromise.

## 7. Interrogate enrolment and recovery

Most real bypasses target enrolment and reset rather than the factor. The questions that matter:

- What proves identity at first enrolment, and can that proof be socially engineered?
- Can a user self-service a reset, and what does that path actually require?
- Does the recovery path fall back to SMS or email, and if so, what is the point of the strong factor?
- Can help desk staff reset a factor, and what verifies the caller? This is exactly the path [Scattered Spider](https://startwithidentity.com/breaches/scattered-spider-helpdesk-social-engineering/) uses.

## 8. Tier your authenticators

Synced [passkeys](https://startwithidentity.com/glossary/passkey/) are what make consumer and workforce adoption possible. Device-bound hardware keys are what you want for administrators, break-glass accounts, and anyone with production access, especially after the August 2026 research on synced key custody. Choose a vendor that supports both classes and lets policy distinguish them. See [best phishing-resistant MFA](https://startwithidentity.com/rankings/best-phishing-resistant-mfa/).

## Where to start

Browse [MFA and passwordless vendors](https://startwithidentity.com/vendors/mfa/) and the [MFA implementation guide](https://startwithidentity.com/guides/authentication/mfa-implementation-best-practices/).