Research
2025-12-11 The quiet threat of 'good enough' MFA
SMS MFA will not save you. Neither will TOTP. Here's what we're telling customers in 2026.
P
Priya Nair 5 min read Multi-factor authentication is not a checkbox. In 2026, 'good enough' MFA is actively harmful: it lets organizations believe they're protected while shipping an exploitable surface.
The current state
SMS and TOTP are trivially phishable with modern adversary-in-the-middle kits. The kits are cheap, the infrastructure is disposable, and the telemetry is weak.
What works
Hardware-bound keys. Device-bound passkeys. Enforced at every entry point.
What to actually do this quarter
Audit your MFA inventory. Find the factors you can phish. Replace the top three.