Why Identity Security Must Move Beyond MFA

Multi-factor authentication is a cornerstone of modern cyber defence, but the piece argues it cannot be relied on alone. It notes that around 70 per cent of users in enterprise environments were using MFA as of early 2025, based on Okta’s Secure Sign-In Trends Report 2025, while also warning that cybercriminals bypass authentication through AI-powered phishing, impersonation, SIM swapping, social engineering and credential theft.

The article explains MFA falls into three categories—something you know, have, or are—and highlights that not all authenticators are equally vulnerable, with concerns about email-based OTPs and SMS codes raised by the FBI and NIST. It cites a rise in phishing‑resistant methods, which have grown from 8.6 per cent to 14.0 per cent in a year, according to the Secure Sign-In Trends Report 2025, including hardware keys and public key cryptography.

It advocates a layered approach that combines MFA with identity threat detection, real‑time monitoring, risk‑based authentication and adaptive policies to better protect data and operations. The author also notes that the human element remains a risk and that organisations should move beyond MFA by adopting continuous identity protection.