How to Choose an MFA Solution

Not all multi-factor authentication is equal. The goal in 2026 is phishing-resistant MFA, not just any second factor.

1. Prioritize phishing resistance

SMS and basic OTP are better than nothing but are phishable and vulnerable to SIM swaps. Favor FIDO2 security keys and passkeys, which resist phishing by design. Our research shows phishing-resistant MFA blocks the overwhelming majority of identity attacks.

2. Cover your whole estate

Modern web apps are easy. The hard parts are VPNs, legacy apps, desktop login, and service accounts. Confirm coverage where you actually need it.

3. Mind enrollment and recovery

Most real-world MFA bypasses target weak enrollment and account recovery, not the factor itself. Evaluate how a vendor handles onboarding and reset.

4. Fit your stack

If you already run a major IAM platform, its built-in MFA may suffice. Standalone specialists shine for workforce passwordless and broad coverage.

5. Name the method class in your policy

A policy that says "require MFA" is satisfied by methods that commodity phishing kits defeat every day. The Mirage2FA campaign reached 4,532 organization domains between 2024 and 2026 without breaking a single factor: it captured the password and the resulting session cookie through legitimate Microsoft 365 login flows and rode the authenticated session.

Write policy against the property, not the acronym. Phishing-resistant means origin-bound: the authenticator refuses to sign for a domain other than the one that registered the credential. Anything a human can read, type, or approve can be relayed.

6. Ask what the vendor does about session theft

MFA at the door does not help if the attacker arrives holding a session that already authenticated. Ask specifically about token binding or device-bound sessions, session revocation APIs, and continuous evaluation, because token theft is now the dominant bypass rather than factor compromise.

7. Interrogate enrolment and recovery

Most real bypasses target enrolment and reset rather than the factor. The questions that matter:

• What proves identity at first enrolment, and can that proof be socially engineered?
• Can a user self-service a reset, and what does that path actually require?
• Does the recovery path fall back to SMS or email, and if so, what is the point of the strong factor?
• Can help desk staff reset a factor, and what verifies the caller? This is exactly the path Scattered Spider uses.

8. Tier your authenticators

Synced passkeys are what make consumer and workforce adoption possible. Device-bound hardware keys are what you want for administrators, break-glass accounts, and anyone with production access, especially after the August 2026 research on synced key custody. Choose a vendor that supports both classes and lets policy distinguish them. See best phishing-resistant MFA.

Where to start

Where to start

Browse MFA and passwordless vendors and the MFA implementation guide.