MFA stands for multi-factor authentication: confirming a user’s identity with two or more independent types of evidence, so that a stolen password alone cannot grant access to an account.
The short answer
MFA requires at least two factors from different categories: something the user knows, something the user has, or something the user is. Because the categories are independent, an attacker who obtains one still cannot authenticate without compromising the second.
On this page
The three authentication factors
Two prompts do not automatically make two factors. A password followed by a security question remains a single category, because both are items of knowledge and both are exposed by the same breach. Multi-factor authentication requires evidence from different categories.
Something you know
Knowledge factor
Password, PIN or security question. Exposed by data breaches, phishing and password reuse.
Something you have
Possession factor
A registered phone running an authenticator application, a hardware security key, or a passkey stored on a device.
Something you are
Inherence factor
Fingerprint or facial recognition. In most systems this unlocks a key held on the device rather than being transmitted to the server.
2FA and MFA
2FA refers to authentication using exactly two factors. MFA is the broader term covering two or more. Most implementations described as MFA use two factors, and auditors and enterprise buyers treat the terms as equivalent.
What MFA prevents
MFA is designed to defeat credential reuse. Passwords are exposed in third-party breaches and then tested against other services, where users have often reused them. Without a second factor, a valid password is sufficient to authenticate.
Comparing MFA methods
Methods differ in strength. The distinction that matters most is phishing resistance: whether the factor can be captured and replayed by an attacker operating a proxy between the user and the legitimate login page.
| Method | How it works | Recommended use |
|---|---|---|
| SMS or email OTP | A one-time code sent to a phone number or mailbox | Only where no alternative exists. Vulnerable to SIM swap and mailbox compromise |
| Authenticator application | A rotating six-digit code generated on the device (TOTP) | Minimum standard for all employee accounts |
| Push approval | An approve or deny prompt sent to a registered device | Acceptable, provided number matching is enabled |
| Passkey or security key | A cryptographic key bound to the legitimate domain (FIDO2, WebAuthn) | Required for administrative, production and finance access |
| Biometrics | Fingerprint or facial recognition unlocking a key stored on the device | Used together with passkeys, not as a standalone factor |
Where frameworks require MFA
| Framework | Status | Where it appears |
|---|---|---|
| PCI DSS v4.0 | Required | Requirement 8.4: MFA for all remote access and for all access into the cardholder data environment. |
| ISO 27001:2022 | Expected | Annex A 8.5 (secure authentication) and A 5.17 (authentication information). |
| SOC 2 | Expected | Not named in the Trust Services Criteria. Auditors treat MFA as the standard logical access control under CC6.1. |
| DPDP Act, 2023 | Implied | Requires reasonable security safeguards. MFA on systems holding personal data is the baseline expectation. |
| Cyber insurance | Asked | Most insurers require MFA on email, remote access and administrative accounts before issuing a quote. |
| Buyer questionnaires | Asked | Whether MFA is enforced on administrative accounts, single sign-on and production access, and whether exceptions exist. |
Known limitations
MFA raises the cost of an attack but does not eliminate it. Three techniques defeat code-based methods: proxy phishing, which captures the session cookie after the user legitimately approves; repeated push notifications, which rely on the user eventually approving one; and SIM swap, which transfers a phone number to an attacker-controlled device.
Coverage is more often the weakness than method. An exempted contractor, a service account or a legacy system outside single sign-on provides the same result as no MFA at all.
Commonly missed accounts
MFA on the identity provider does not extend to systems outside it. Direct database access, SSH into production and administrative panels that predate single sign-on should be verified first.
How Osto handles MFA
Osto enforces MFA at the network layer rather than relying on each application. The ZTNA module places cloud servers and internal resources behind a private domain, and those resources remain unreachable unless the Osto endpoint agent is installed and MFA is satisfied. Systems that would otherwise sit outside single sign-on are covered by default.
The IAM module manages identity and access across the stack. Because authentication events are recorded in the same platform as endpoint, WAF and cloud activity, a suspicious sign-in can be correlated with subsequent behaviour rather than reviewed in isolation.
Free security assessment
Find the accounts your MFA policy does not cover
Osto gates internal resources behind ZTNA with agent and MFA enforcement, and manages identity across the stack. Tell us your scope and we will tailor a plan.
Get a free security assessment Book a platform walkthroughDeploys in hours · No dedicated security team required · One platform, everything
Frequently asked questions
What does MFA stand for?
MFA stands for multi-factor authentication. It means confirming a user’s identity with two or more independent types of evidence, drawn from different categories: something the user knows, something the user has, or something the user is.
Is MFA the same as 2FA?
2FA uses exactly two factors. MFA covers two or more. Most implementations use two, and auditors, insurers and enterprise buyers treat the terms as equivalent.
Which MFA method is the most secure?
Passkeys and hardware security keys based on FIDO2 or WebAuthn, because the credential is cryptographically bound to the legitimate domain and cannot be replayed against a fraudulent login page. Authenticator applications are the minimum standard. SMS is the weakest common option, as a SIM swap transfers the number to an attacker.
Is MFA required for SOC 2?
The Trust Services Criteria do not name MFA specifically. Auditors treat it as the standard control for logical access under CC6.1, and an environment without MFA on administrative accounts will normally result in a finding.
Can MFA be bypassed?
Yes. Proxy phishing can capture a session cookie after a legitimate approval, repeated push notifications rely on a user approving one, and SIM swap defeats SMS codes. Phishing-resistant factors on high-value accounts, combined with complete coverage and no exemptions, address most of these cases.