MFA statistics 2026

Okta found that 70% of workforce users at Okta Workforce Identity customers signed in with MFA as of January 2025, leaving nearly a third without it.

Source: Okta, The Secure Sign-in Trends Report 2025, published December 9, 2025

Method: Anonymized, aggregated data from billions of monthly authentications by Okta Workforce Identity customers as of January 2025, measured as the share of users who signed in with each authenticator. Last checked 2026-11-05.

Phishing-resistant authenticators (Okta FastPass, WebAuthn and smart cards combined) were used by 14.0% of Okta workforce users in January 2025, up from 8.6% a year earlier.

Source: Okta, The Secure Sign-in Trends Report 2025, published December 9, 2025

Method: Anonymized, aggregated data from billions of monthly authentications by Okta Workforce Identity customers as of January 2025, measured as the share of users who signed in with each authenticator. Last checked 2026-11-05.

Use of SMS as a sign-in factor fell to 15.3% of Okta workforce users in January 2025, down from 17.5% a year earlier.

Source: Okta, The Secure Sign-in Trends Report 2025, published December 9, 2025

Method: Anonymized, aggregated data from billions of monthly authentications by Okta Workforce Identity customers as of January 2025, measured as the share of users who signed in with each authenticator. Last checked 2026-11-05.

The technology sector had the highest MFA adoption among Okta workforce customers at 87% of users, while transportation and warehousing was lowest at 42%.

Source: Okta, The Secure Sign-in Trends Report 2025, published December 9, 2025

Method: Anonymized, aggregated data from billions of monthly authentications by Okta Workforce Identity customers as of January 2025, measured as the share of users who signed in with each authenticator. Last checked 2026-11-05.

47% of UK businesses had some requirement for two-factor authentication when people access their network or applications in 2025/26, up from 40% in 2024/25.

Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026, published April 30, 2026

Method: Random probability telephone and online survey of 2,112 UK businesses, 1,085 UK registered charities and 577 education institutions, carried out between August and December 2025. Last checked 2026-11-05.

90% of large UK businesses required two-factor authentication for network access in 2025/26, against 47% of all businesses and 38% of charities.

Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026, published April 30, 2026

Method: Random probability telephone and online survey of 2,112 UK businesses, 1,085 UK registered charities and 577 education institutions, carried out between August and December 2025. Last checked 2026-11-05.

Only 48% of employed adults surveyed by Yubico in nine countries said their company uses MFA across all apps and services.

Source: Yubico, Cybersecurity Wakeup: Gen Z Tops the List for Falling for Phishing Attacks (2025 Global State of Authentication survey), published September 30, 2025

Method: Online double-opt-in survey of 18,000 employed adults (2,000 in each of 9 countries) conducted by Talker Research for Yubico between August 15 and August 27, 2025. Last checked 2026-11-05.

29% of employed adults surveyed by Yubico in nine countries do not have MFA set up on their personal email accounts.

Source: Yubico, Cybersecurity Wakeup: Gen Z Tops the List for Falling for Phishing Attacks (2025 Global State of Authentication survey), published September 30, 2025

Method: Online double-opt-in survey of 18,000 employed adults (2,000 in each of 9 countries) conducted by Talker Research for Yubico between August 15 and August 27, 2025. Last checked 2026-11-05.

Microsoft says phishing-resistant MFA can stop >99% of identity-based attacks, even when the attacker has the correct username and password.

Source: Microsoft, Microsoft Digital Defense Report 2025, published October 16, 2025

Method: Microsoft telemetry from more than 100 trillion daily signals, including 38 million identity risk detections a day, covering July 2024 through June 2025. Last checked 2026-11-05.

Microsoft Research found MFA reduces the risk of account compromise by 99.22% across a large population of Azure Active Directory accounts that showed suspicious activity.

Source: Microsoft Research, How effective is multifactor authentication at deterring cyberattacks?, published May 2023

Method: Benchmark-multiplier analysis with manual account review of a large dataset of Microsoft Azure Active Directory users who showed suspicious activity. Last checked 2026-11-05.

For accounts whose credentials had already leaked, Microsoft Research found MFA reduced the risk of compromise by 98.56%.

Source: Microsoft Research, How effective is multifactor authentication at deterring cyberattacks?, published May 2023

Method: Benchmark-multiplier analysis with manual account review of a large dataset of Microsoft Azure Active Directory users who showed suspicious activity. Last checked 2026-11-05.

Over 99.99% of MFA-enabled accounts in Microsoft Research's Azure Active Directory study remained secure during the investigation period.

Source: Microsoft Research, How effective is multifactor authentication at deterring cyberattacks?, published May 2023

Method: Benchmark-multiplier analysis with manual account review of a large dataset of Microsoft Azure Active Directory users who showed suspicious activity. Last checked 2026-11-05.

Microsoft reports password attacks fell 26% year over year in its July 2025 to June 2026 reporting period, which it attributes to MFA and passkeys forcing attackers to other methods.

Source: Microsoft, Microsoft Digital Defense Report 2026, published October 2026

Method: Microsoft threat intelligence telemetry for the July 2025 to June 2026 reporting period, compared with July 2024 to June 2025. Last checked 2026-11-05.

At 35 organizations targeted by one threat group, median enrollment in phishing-resistant factors rose from 23% to 95% after Okta warned them of an impending attack.

Source: Okta, The most targeted companies choose phishing-resistant MFA, published January 23, 2025

Method: Okta measured phishing-resistant factor enrollment at 35 organizations known to have been targeted by one threat group between 2022 and early 2024, before notification and as of March 2024. Last checked 2026-11-05.

Adversary-in-the-middle phishing, which captures MFA codes and session cookies in real time, accounted for 44.6% of phishing techniques Microsoft identified in its 2026 reporting period.

Source: Microsoft, Microsoft Digital Defense Report 2026, published October 2026

Method: Microsoft telemetry on identified phishing techniques for the July 2025 to June 2026 reporting period. Last checked 2026-11-05.

Cisco Talos observed authentication abuse, often bypassing MFA through AiTM proxies, session-token theft, MFA fatigue and self-enrolled devices, in 65% of its incident response engagements in Q2 2026, up from 35% the quarter before.

Source: Cisco Talos, IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains, published July 28, 2026

Method: Share of Cisco Talos Incident Response engagements in the second quarter of 2026 where authentication abuse was observed, compared with the first quarter. Last checked 2026-11-05.

Missing or insufficient authentication and MFA controls were the third most common security weakness in Cisco Talos incident response engagements in Q3 2026, seen in 33% of them.

Source: Cisco Talos, IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases, published October 29, 2026

Method: Share of Cisco Talos Incident Response engagements in the third quarter of 2026 where the weakness was observed. Last checked 2026-11-05.

Of organizations hit by cloud account takeover, 59% had MFA enabled on the compromised accounts, according to Proofpoint's November 2024 to November 2025 analysis.

Source: Proofpoint, From initial access to post-compromise abuse: what our latest ATO analysis reveals, published February 25, 2026

Method: Proofpoint review of attempted and successful cloud account takeover activity across its customer base between November 2024 and November 2025. Last checked 2026-11-05.

Suspicious MFA manipulation after account takeover was seen at 12% of organizations impacted by takeovers in Proofpoint's 12-month analysis.

Source: Proofpoint, From initial access to post-compromise abuse: what our latest ATO analysis reveals, published February 25, 2026

Method: Proofpoint review of attempted and successful cloud account takeover activity across its customer base between November 2024 and November 2025. Last checked 2026-11-05.

Microsoft rolled out mandatory MFA for Azure portal sign-ins to 100% of Azure tenants in March 2025, with Phase 2 enforcement for CLI, PowerShell and APIs starting October 1, 2025.

Source: Microsoft, Azure mandatory multifactor authentication: Phase 2 starting in October 2025, published September 5, 2025

Method: Microsoft's own account of its enforcement rollout across Azure Public Cloud tenants. Last checked 2026-11-05.

Okta's mandatory MFA policy for administrator console access, introduced in 2024, resulted in 100% MFA adoption among customer admins by August 2025.

Source: Okta, The Secure Sign-in Trends Report 2025, published December 9, 2025

Method: Anonymized, aggregated data from billions of monthly authentications by Okta Workforce Identity customers as of January 2025, measured as the share of users who signed in with each authenticator. Last checked 2026-11-05.

Phishing-resistant MFA protects 99.97% of user/device pairs at Microsoft, according to its July 2026 Secure Future Initiative progress report.

Source: Microsoft, Securing our future: July 2026 progress report on Microsoft's Secure Future Initiative, published July 10, 2026

Method: Microsoft's internal measurement of its own user/device pairs, reported in its Secure Future Initiative progress report. Last checked 2026-11-05.