How MFA gets hacked — and strategies to prevent it

Multifactor authentication (MFA, a security method requiring multiple forms of proof of identity) is widely recognized as important but often poorly implemented, leaving organizations vulnerable to attacks including AI-powered phishing, prompt bombing (overwhelming users with repeated MFA requests), social engineering, and token theft. While larger enterprises increasingly use MFA and passwordless approaches (authentication methods that don't rely on passwords) are improving ease of use, surveys show significant gaps: only about a third of smaller firms use MFA regularly, and fewer than 20% of enterprises have deployed phishing-resistant MFA methods despite 87% believing they are critical.