Turning on multi-factor authentication remains the single highest-value security change most organisations can make. We still recommend it first, and we still find organisations that have not finished rolling it out. None of what follows argues against it.
But MFA is now the baseline rather than the destination, and the attacks that matter have adapted to it.
How accounts are taken over now
The common pattern is no longer guessing a password. It is a convincing sign-in page that sits between the user and the real service, passes the credentials through, passes the MFA prompt through, and captures the session token that the service issues afterwards. The user signs in successfully and notices nothing. The attacker replays the token and is inside without needing to authenticate again.
The second pattern is simpler. An attacker with a valid password triggers approval prompts repeatedly, often late at night, until someone taps approve to make it stop.
What helps
- Phishing-resistant methods — passkeys or hardware keys — for administrators and anyone handling payments
- Number matching, so approving a prompt requires reading a code rather than tapping a button
- Conditional access that considers device compliance and location, not just identity
- Shorter session lifetimes on unmanaged devices, so a stolen token expires sooner
- Alerting on impossible travel and new-device sign-ins, with someone rostered to act on it
Start with the accounts that matter
Rolling passkeys out to an entire organisation at once is how these projects stall. Start with the accounts where takeover would be most damaging: global administrators, finance approvers, and anyone who can change payment details. That is usually a small enough group to move in a fortnight.
The goal is not to make sign-in impossible to phish for everyone. It is to make the accounts worth phishing the hardest ones to reach.
If you are unsure which of your accounts hold privileged roles, that is the first thing to establish — and it is usually a shorter list than people expect, with two or three names on it that surprise everyone.