Multi-factor authentication (MFA)
Identity verification with two or more independent factors. It makes a stolen password insufficient, though not invulnerable.
Full definition
Multi-factor authentication (MFA) requires two or more independent proofs of identity before granting access: something the person knows (password), something they have (phone, hardware key) or something they are (biometrics). Its practical effect is that a stolen password stops being enough.
It is one of the best cost-benefit measures in corporate security, but not all factors protect equally: SMS codes can be intercepted, and approval notifications open the door to MFA fatigue, where the attacker bombards the victim until they accept. Hardware keys and passkeys resist phishing best.
MFA does not cover everything either: session hijacking steals the cookie created after login, and adversary-in-the-middle attacks capture the code in real time. That is why it is combined with credential monitoring and behavior training.
Related terms
MFA fatigue
A barrage of approval notifications until the victim accepts out of exhaustion. The attacker already has the password; only the second factor is missing.
Session hijacking
Stealing the cookie or token that keeps an authenticated session open. It grants entry without a password and without a second factor.
Leaked credentials
Usernames and passwords exposed in breaches or stolen by malware, circulating on the dark web. They are the raw material of initial access to companies.
From definition to data: measure your company's human risk
Fensivo detects leaked credentials, simulates real attacks and validates with retests that behavior changed.