I've spent the last few years rolling out the usual security basics across our organization: MFA everywhere, password managers, secure email gateways, regular phishing training, and the other standard controls. Lately, though, I'm less confident that those measures are enough on their own. AI-generated phishing is much more convincing, MFA fatigue attacks are still effective, and deepfake voice calls make impersonation harder to recognize. It feels like attackers are increasingly working around our controls rather than trying to break them directly. What are security teams doing now? Are the traditional protections still considered a solid baseline, or should we be moving toward different authentication and access controls?
4 Answers
Treat identity as only one layer. Require access from managed, compliant devices, use conditional access with sensible location and sign-in risk policies, keep sessions short where appropriate, and separate administrator accounts from normal user accounts. Token protection and device-bound authentication can also help prevent a stolen session from being replayed elsewhere. Review your policies regularly, especially exclusions and rules that were left in report-only mode.
MFA is still valuable, but “MFA enabled” isn’t the finish line anymore. Push approvals, SMS codes, and TOTP can be phished or abused through MFA fatigue and adversary-in-the-middle attacks. The stronger direction is phishing-resistant authentication such as passkeys, FIDO2 security keys, Windows Hello for Business, smart cards, or certificate-based authentication. Start with administrators, finance users, executives, and other high-impact accounts if a full rollout isn’t practical yet.
That makes sense. I hadn’t fully appreciated that the attacker can steal the session after the user completes MFA legitimately. I’m going to look more closely at passkeys and hardware-backed options.
Think in layers rather than searching for one replacement for MFA. Keep MFA, but add phishing-resistant methods, SSO, least privilege, endpoint protection, patching, backups, network segmentation, centralized logging, and monitoring that can quickly detect identity-based attacks. The right mix depends on your staff, budget, and ability to operate the controls. A sophisticated system that nobody maintains can be less effective than a simpler one that is consistently enforced.
That’s probably the most realistic way to frame it. We have many of the basics already, but we need to prioritize the controls we can actually operate well instead of assuming one technology solves everything.
The technical controls need to be paired with process controls. Deepfake calls and convincing phishing often succeed because someone approves a payment, changes vendor details, or resets MFA based on a believable request. Require independent callback verification using a trusted number for financial changes and sensitive account recovery. Also audit how the help desk verifies a caller before resetting MFA; that process is often weaker than the login itself.
The managed-device requirement is especially important. A stolen token is much less useful if it can’t be used from an unmanaged endpoint.