"We Have MFA" Isn't the Answer It Used To Be
For years, enabling any form of multi-factor authentication was enough to satisfy an exam question. That's no longer true. SMS codes and simple push approvals are both vulnerable to real-world attacks — SIM swapping, push fatigue, and adversary-in-the-middle proxies that harvest a session token the moment a user approves a prompt. Examiners increasingly ask not just whether MFA exists, but what kind, and where.
What "Phishing-Resistant" Actually Means
- Phishing-resistant: FIDO2/WebAuthn security keys or platform passkeys, and PIV/CAC-style certificate-based authentication. These bind the credential to the specific site, so a fake login page can't capture a usable factor.
- Not phishing-resistant: SMS one-time codes, voice calls, and basic push-to-approve without number matching. All three can be relayed or approved under pressure by a user who doesn't realize they're being targeted.
Push notifications with number matching and geographic context are a meaningful improvement over plain push, but they're still a step below phishing-resistant methods for your highest-risk accounts.
Where to Prioritize First
A full passkey rollout across every employee is a big lift. Start where the risk is concentrated:
- Domain admin and privileged IT accounts.
- Anyone with standing access to wire or ACH origination systems.
- VPN and remote access used by IT and executives.
- Email admin accounts — a common pivot point for business email compromise.
Broader staff rollout can follow once the highest-risk accounts are covered, rather than waiting on a single all-at-once cutover.
Documenting It for an Exam
Keep a simple inventory: which systems require MFA, which factor type is in use per system, and the date it was enforced. If any privileged account is still on SMS or basic push, note it as a tracked exception with a remediation date rather than leaving it silent — examiners react far better to a documented gap with a plan than an undocumented one they find themselves.
Need Help Prioritizing the Rollout?
If you're not sure which accounts to move first or how to phase the transition, reach out. We can help you build a rollout plan that fits your environment and your exam timeline.