Passwords alone no longer protect accounts. Multi-factor authentication (MFA) adds a second proof of identity, so a stolen password is not enough. But attackers have adapted, and some MFA methods are much stronger than others. Here is how to choose.
The main MFA methods compared
| Method | Strength | Main weakness |
|---|---|---|
| SMS or voice code | Basic | SIM swapping and interception; easy to phish |
| Email code | Basic | Only as safe as the mailbox itself |
| Authenticator app (one-time code) | Good | Codes can still be typed into a fake site |
| Push approval | Good | Approval fatigue: users tap yes to stop the notifications |
| Push with number matching | Stronger | Still depends on user attention |
| Hardware security key or passkey | Strongest | Cost and rollout effort |
Why phishing-resistant MFA matters
Modern attacks do not try to guess your code. They put up a fake login page, collect your password and your one-time code, and use both at once on the real site. Hardware keys and passkeys are bound to the real website address, so they refuse to work on a fake page. That is why security agencies recommend phishing-resistant MFA for administrators and for any account that can reach sensitive data.
Approval fatigue is real
If an attacker has your password, they can trigger login prompts again and again at night until someone approves one. Number matching, where the user must type a number shown on the login screen, and limits on repeated prompts reduce this risk a lot.
Where to start
- Protect the highest risk first. Administrator accounts, email, remote access and VPN, and finance systems.
- Turn off the weakest methods where better ones are available.
- Use conditional access. Ask for stronger proof when the location, device or behaviour looks unusual.
- Cover remote access. A VPN or remote desktop without MFA is one of the most common ways in.
- Plan recovery. Decide how staff regain access when they lose a phone, without creating an easy bypass.
MFA and compliance
MFA is expected by cyber insurers and is a named measure in frameworks such as NIS2 and ISO 27001. Being able to show where it is enforced is often what an auditor asks first.
How Guardbyte can help
We design and deploy MFA, including WatchGuard AuthPoint, across VPN, cloud apps and endpoints. See our multi-factor authentication solution or talk to us about the right rollout for your team.
Are you ready to accelerate your business?
Our experts are ready to support your growth with advanced solutions designed to protect your business and keep you moving forward with confidence.
