.png)
What is Phishing-Resistant MFA?
Phishing-resistant MFA uses origin binding so an attacker's proxy cannot relay authentication. Which methods qualify, which don't, and how to deploy it.
What Makes MFA Phishing-Resistant
The defining property is origin binding. A phishing-resistant authenticator cryptographically verifies which website is requesting authentication before releasing anything. If the request comes from login.microsoftonline.com, the authenticator responds. If it comes from microsoftonline-verify[.]com, it does not — regardless of how convincing the page looks or how certain the user is that they should proceed.
This removes human judgment from the security decision, which is the point. Users cannot be trained reliably to detect a pixel-perfect proxy with a valid TLS certificate. The authenticator can.
Which Methods Qualify
FIDO2 security keys. Physical hardware — YubiKey, Titan, Feitian. Origin-bound, phishing-resistant, portable across devices.
Platform authenticators. Windows Hello for Business, Touch ID and Face ID via WebAuthn. Same protocol, biometric or PIN unlock, bound to the device.
Passkeys. FIDO2 credentials that can sync across a user's devices. Phishing-resistant with the same origin-binding property; the syncing introduces a separate set of considerations around the sync provider.
Certificate-based authentication. Smart cards and PIV/CAC credentials. Long-established in government and defense, origin-bound by design.
Which Methods Do Not Qualify
SMS one-time codes. Vulnerable to SIM swap, interception, and relay. Widely deprecated for privileged use.
TOTP authenticator apps. Better than SMS, still relayable — the user types the code into whatever page asked for it, including a proxy.
Push notification approval. Relayable and additionally vulnerable to MFA fatigue attacks.
Number matching push. A real improvement over simple approve/deny, and still relayable by a proxy that displays the number.
The distinction is not about strength in the abstract. It is about whether the method can be relayed by a proxy standing between the user and the real service.
Deployment Sequence
Full-organization rollout is a program. Meaningful risk reduction is not, and the sequence matters more than the timeline.
First: privileged and executive accounts. Domain admins, global admins, finance staff with payment authority, and the executive team. This is a small population and it covers most of the blast radius. It can typically be done in weeks.
Second: anyone who can approve payments or reset credentials. Helpdesk staff and finance operations are the accounts attackers target to reach everything else.
Third: the general workforce. Broader rollout with hardware key distribution or platform authenticator enablement, phased by department.
Throughout: remove the weak methods. Deploying FIDO2 while leaving SMS enabled as a fallback preserves the vulnerability, because the attacker will simply drive the victim to the fallback. Phishing-resistant MFA is only phishing-resistant when the weaker methods are disabled for that account.
That last point is the most common implementation failure. Organizations deploy hardware keys, report high adoption, and leave SMS available for account recovery. The attacker uses account recovery.
Cost and Objections
Hardware keys cost roughly $25-70 per unit. Platform authenticators cost nothing where the hardware already supports them, which on modern Windows and Apple fleets is most of it. Against the remediation cost of a single session-theft intrusion, the economics are not close.
The common objections — user friction, lost keys, shared workstations, contractor access — all have established answers. They are implementation problems, not reasons to defer.
Regulatory and Contractual Pressure
Phishing-resistant MFA is moving from best practice to requirement. CISA has recommended it for critical infrastructure. Federal agencies are subject to it under Executive Order 14028 and OMB M-22-09. Cyber insurance underwriters increasingly ask about MFA method specifics rather than accepting a yes/no on MFA coverage. Enterprise procurement questionnaires have begun to follow.
For a portfolio company, the practical implication is that MFA: yes is no longer a sufficient answer in an insurance application, a customer security review, or a diligence questionnaire. The follow-up question is which methods, on which accounts.
Related Reading
The Control That Was Missing
Across the 2025-2026 intrusion wave — UK retail, Aura, RingCentral, Apollo Global Management — the victim organizations had MFA deployed. In each case the attacker obtained authenticated access anyway, by relaying or resetting the second factor.
Phishing-resistant MFA on the compromised accounts would have broken the chain at step one. The authenticator would not have responded to the lookalike domain, and no session token would have been issued to the attacker.
per hardware security key. Against the remediation, notification, and litigation cost of a single session-theft intrusion, phishing-resistant MFA is among the cheapest material controls available.