Passwords have one structural problem: they are a single point of failure. If an attacker obtains a credential through phishing, a data breach, or credential stuffing, a password-only system has no second line of defense. Multi-factor authentication (MFA) addresses this directly by requiring proof from more than one category of evidence before granting access.
MFA is not a new idea, but it has become a baseline expectation in sound security practice. NIST Special Publication 800-63B covers authenticator types and assurance levels in detail, and CISA consistently names MFA as one of the highest-value controls any organization can implement.
The Three Factor Categories
Every authentication factor falls into one of three categories. Understanding the categories matters because MFA requires factors from at least two different categories, not just two pieces of information.
Something you know is knowledge-based: a password, a PIN, a passphrase, or a security question answer. This is the most common factor and the weakest in isolation, because knowledge can be guessed, observed, or stolen.
Something you have is a physical or digital object in your possession: a hardware security key, a smartphone running an authenticator app, a smart card, or a one-time passcode (OTP) sent to a registered device. This factor is meaningful because an attacker typically needs physical access to your device to use it.
Something you are covers biometrics: fingerprints, facial recognition, iris scans, voice patterns. These are harder to replicate than passwords, though they carry their own tradeoffs around privacy and false acceptance rates.
A system asking for a password and then a six-digit code from an authenticator app is using two factors from two different categories: something you know, and something you have. That combination is what makes it MFA.
Why MFA Works
The security value of MFA comes from making simultaneous credential compromise significantly harder. An attacker who steals a password through a phishing campaign still needs the second factor. If that second factor is a hardware key or a time-based OTP on a device the attacker does not control, the stolen password does not get them in.
CISA's guidance on MFA notes that enabling MFA makes users significantly less likely to be compromised. The control does not eliminate risk entirely, but it raises the cost and complexity of an attack enough to stop the majority of opportunistic attempts.
Common MFA Methods
Not all MFA implementations carry equal weight. Here is how common methods compare in practice:
Authenticator apps (such as Google Authenticator or Authy) generate time-based one-time passwords (TOTP) that expire every 30 seconds. These are a solid general-purpose choice for most users and services.
Hardware security keys (such as FIDO2/WebAuthn devices) are among the strongest options available. They are resistant to phishing because the key cryptographically binds to the legitimate site, not a spoofed one.
SMS-based OTPs are widely deployed and better than no MFA, but carry documented weaknesses. SIM swapping attacks can redirect SMS messages to an attacker's device, bypassing this factor. NIST 800-63B addresses this, and security practitioners generally treat SMS OTP as a weaker option when stronger alternatives exist.
Push notifications from mobile apps ask users to approve or deny a login attempt. These are convenient but vulnerable to MFA fatigue attacks, where an attacker sends repeated push requests hoping the user will approve one to make them stop.
Common Misconceptions
Two-factor authentication and MFA are not the same thing, but two-factor is a subset of MFA. Two-factor authentication (2FA) specifically uses exactly two factors. MFA is the broader term covering two or more. In practice, most implementations are 2FA, but the vocabulary matters when reading standards and policies.
Using the same factor type twice does not count as MFA. A password plus a security question is two pieces of knowledge: both fall into the something you know category. That is not MFA because both factors can fail for the same reason, such as a phishing page capturing both.
MFA does not make an account immune to attack. Sophisticated phishing kits can relay credentials and session tokens in real time, bypassing some MFA methods. This is one reason hardware keys with FIDO2 are rated more highly than OTPs for high-value accounts: the cryptographic binding to the legitimate site prevents real-time relay attacks.
How MFA Fits a Sound Security Posture
MFA is a control that addresses authentication, which sits at the boundary between access and no access. Framing it against the CIA triad: MFA primarily serves Confidentiality by ensuring that access to sensitive information requires verified identity, not just a guessable or stolen credential.
From a risk reduction standpoint, MFA is one of the most efficient controls available. It does not require complex infrastructure to implement for most services, and the reduction in account compromise risk is significant relative to the effort. CISA's Known Exploited Vulnerabilities catalog regularly includes vulnerabilities exploited after attackers gain initial access through compromised credentials, which MFA would have blocked at the door.
For any system handling sensitive data, MFA on privileged and user accounts should be treated as a baseline requirement, not an optional hardening step.