Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More

For a long time, multi-factor authentication (MFA) -- in the way of push notifications, authenticator apps or other secondary steps -- was thought to be the answer to the mounting cybersecurity problem.

But hackers are cunning and crafty and come up with new ways all the time to break through the fortress of MFA.

Today's enterprises need even stronger defenses -- while experts say MFA is still critical, it should be just a small piece of the authentication process.

"Traditional MFA methods, such as SMS and push notifications, have proven to be vulnerable to various attacks, making them nearly as susceptible as passwords alone," said Frank Dickson, group VP for security and trust at IDC. "The growing prevalence of sophisticated threats requires a move towards stronger authentication methods."

Why isn't MFA enough?

The once tried-and-true practice of relying on passwords now seems quaint.

No matter what string of numbers, letters, special characters or numbers they comprised, they became so easy to steal as users were careless, lazy, gullible or overtrusting.

"Traditional passwords are simply shared secrets, not much more advanced than a Roman sentry asking for the secret codeword thousands of years ago ('Halt, who goes there? What's the passcode?)," said Lou Steinberg, founder and managing partner at CTM insights.

As Matt Caulfield, VP of product for identity security at Cisco, told VentureBeat: "As soon as those were stolen, it was game over."

MFA became more mainstream in the mid-1990s to 2000s as more enterprises went online, and it seemed a solution to traditional passwords. But with digital transformation, the shift to the cloud, and the adoption of dozens or even hundreds of SaaS apps, enterprises are more vulnerable than ever. They no longer safely hide away behind firewalls and data centers. They lack control and transparency.

"MFA changed the game for a long time," said Caulfield. "But what we've found over the past 5 years with these recent identity attacks is that MFA can easily be defeated."

One of the greatest threats to M ...