MFA isn't enough anymore: what modern identity security looks like

For years the advice was clean and correct: enable multi-factor authentication and you close the door on the overwhelming majority of account takeovers. A stolen password alone stops being enough. That advice worked so well that attackers did what attackers always do — they adapted. Today the identity attacks we see in the field are specifically engineered to get around the most common form of MFA: the app that sends a push notification asking "Was this you?"

The uncomfortable truth is that not all MFA is created equal, and the kind most organizations turned on first is now the kind attackers have learned to defeat.

How basic MFA gets beaten

There are three techniques we encounter constantly, and none of them require the attacker to break any cryptography.

Push fatigue (MFA bombing)

Once an attacker has a valid password — from a breach dump, a phishing kit, or reuse across sites — they log in over and over, firing off a stream of approval prompts to the victim's phone. Late at night, mid-meeting, or simply worn down, someone eventually taps "Approve" to make the buzzing stop. That single tap is the whole attack.

Real-time phishing proxies

Modern phishing kits don't just harvest a password. They sit between the user and the real login page, relaying every field — including the one-time code — in real time, then capturing the resulting session token. The victim genuinely logs in; the attacker rides the authenticated session. The six-digit code did its job and was defeated anyway.

Token and session theft

Malware on an endpoint can lift the session cookie a browser holds after a successful MFA login. With that token, the attacker skips authentication entirely. The account was protected by MFA; the session that MFA produced was not.

The common thread: basic MFA verifies a moment, not a context. It confirms that someone could approve a prompt or type a code once — and then trusts the rest. Modern identity security is about verifying who, what device, from where, and whether that still makes sense, continuously.

What actually raises the bar

The good news is that the countermeasures are well understood and largely available in tools businesses already own. They fall into three layers.

Phishing-resistant MFA

The strongest fix is to remove the human-copyable secret entirely. Standards like FIDO2 and passkeys — hardware security keys and platform authenticators — bind the login to the actual website's identity using cryptography. A phishing proxy on a look-alike domain simply cannot complete the handshake, because the key refuses to authenticate to the wrong origin. There's no code to relay and no prompt to fatigue. Where hardware keys aren't practical, number-matching (the user types a code shown on screen into the app, rather than tapping "Approve") shuts down the simplest push-bombing.

Device trust

Authentication should consider the device, not just the person. Is this a managed, encrypted, up-to-date laptop the company recognizes — or an unknown machine in a country where you have no employees? Device trust ties access to healthy, enrolled endpoints, so a stolen password from an unmanaged device gets stopped even if the credential is valid.

Conditional access

This is the policy engine that ties it together: rules that evaluate the full context of every login and respond accordingly. Impossible travel, an unfamiliar location, a risky sign-in pattern, an unmanaged device — any of these can trigger a step-up challenge or an outright block. Access becomes a continuous decision rather than a one-time gate.

Together these implement what the industry calls zero trust: never assume a session is safe because it authenticated once. Zero-trust multi-factor authentication (MFA) & device trust platforms make this reachable for growing businesses without an enterprise identity team — layering device posture checks and adaptive policy on top of the sign-in you already have.

Practical steps you can take now

You don't need to boil the ocean. In rough priority order:

• Turn off "tap to approve" and switch to number-matching everywhere it's available today.
• Issue phishing-resistant keys or passkeys to your highest-risk accounts first — executives, finance, IT admins, anyone who can move money or change permissions.
• Require that logins come from managed, healthy devices for access to sensitive systems.
• Write conditional-access policies for the obvious wins: block or challenge unfamiliar locations and impossible travel.
• Shorten session lifetimes on sensitive apps so a stolen token expires fast.
• Monitor identity signals the same way you monitor endpoints — a wave of failed MFA prompts is an attack in progress, not a nuisance.

Where Atom fits

Identity is now the front line, which is why we treat it as an operated service rather than a one-time setup. We help clients deploy zero-trust access — phishing-resistant factors, device trust, and conditional-access policy tuned to how your people actually work — and then we watch it. Those login signals flow into the same SOC that watches endpoints and email, so a push-bombing campaign or an impossible-travel alert gets a human response in minutes rather than showing up in a report next quarter.

MFA was never wrong. It was a floor, not a ceiling. The organizations that get burned in the next few years won't be the ones without MFA — they'll be the ones who turned it on, checked the box, and assumed the attackers would stop trying. They didn't.