The security benefits of multifactor authentication (MFA) are well-known, yet MFA continues to be poorly, sporadically, and inconsistently implemented, vexing business security managers and their users. Often, MFA users have an extra workflow burden with the additional factors, one of many obstacles to their continued success.

And the frequent news stories that describe innovative ways to circumvent MFA don’t help either, such as recent news of a spear-phishing attack by North Korean-state sponsored group that targeted the Microsoft 365 installations of small businesses. In 2022, we saw Okta hit with a series of attacks that stole its GitHub source code to infect its supply chain, steal user credentials in two separate attacks, and compromise its support portal. Being an authentication vendor, and providing less-than-stellar transparency about what happened in each of these events, shows how hard it is to properly implement MFA.

But it isn’t all gloom and doom. MFA methods have gotten easier to use, thanks to the growth in popularity and sophistication of passwordless approaches. The post-pandemic diaspora — along with US President Biden’s 2021 Executive Order on Improving the Nation’s Cybersecurity and MFA mandates in 2021 by Google for all of its employees, and most recently Microsoft for Azure sign-ins — have helped motivate IT operations to strengthen their authentication practice, and encourage comprehensive and continuous authentications across all applications. According to one survey, two thirds of ordinary users regularly employ MFA methods, and the proportion of administrators that protect their logins has risen to 90%.