What is Multi-Factor Authentication (MFA)? Definition & Explanation

Multi-Factor Authentication (MFA) requires users to present two or more independent verification factors — something you know (password), something you have (token, phone), and something you are (biometric) — before granting access. MFA dramatically reduces the success rate of credential-based attacks.

In-Depth Explanation

MFA factor types vary widely in security strength. Weakest is SMS OTP (vulnerable to SIM swapping, SS7 attacks, and AiTM phishing) — NIST 800-63B has deprecated it for high-assurance use. Stronger options include Time-based One-Time Passwords (TOTP via Google Authenticator, Microsoft Authenticator, Authy, 1Password — vulnerable to AiTM), push-based MFA (Microsoft Authenticator, Duo, Okta Verify — vulnerable to MFA fatigue/push bombing), and number matching (mitigates push fatigue). The gold standard is phishing-resistant MFA: FIDO2/WebAuthn hardware security keys (YubiKey, Titan Key, Feitian) and platform passkeys (Apple Passkeys, Google Passkeys, Microsoft Hello) — these use cryptographic challenge-response with channel binding, making them immune to AiTM phishing. Modern enterprise rollouts now favor passwordless authentication via FIDO2 + passkeys with conditional-access policies based on device health, location, and risk. Adoption of phishing-resistant MFA is now mandated by CISA for federal agencies and increasingly by cyber-insurance underwriters.

Why It Matters for Security

Microsoft research shows MFA blocks 99.2% of automated account-compromise attacks. Phishing-resistant MFA (FIDO2 hardware keys, passkeys) blocks essentially 100%. SMS and push-based MFA are still being defeated routinely by AiTM phishing kits and MFA-fatigue attacks (the Uber 2022 breach used MFA fatigue). The shift to phishing-resistant MFA is the single highest-leverage security investment any organization can make in 2026.

Related Tools

Frequently Asked Questions

What does Multi-Factor Authentication (MFA) mean in cybersecurity?

Multi-Factor Authentication (MFA) in cybersecurity requires users to present two or more independent verification factors — typically something you know (password), something you have (security key or phone), and something you are (biometric) — before granting access to a system.

Why is Multi-Factor Authentication (MFA) important?

MFA matters because it blocks over 99% of automated account-compromise attacks (per Microsoft research). Phishing-resistant FIDO2 MFA blocks essentially all attacks, including modern Adversary-in-the-Middle kits that defeat SMS and push-based MFA. Adopting phishing-resistant MFA is the single highest-impact security investment available.

← Back to the full Cybersecurity Glossary