Half of insured organizations were required to upgrade their MFA tools to qualify for or renew a cyber insurance policy. For many, what they had was not enough. Insurers are no longer treating MFA as a yes or no question. They want to know what kind. Legacy MFA, including SMS codes, push notifications and authenticator apps, are increasingly failing their tests. This page covers what insurers are now requiring, why legacy MFA falls short and what phishing-resistant authentication looks like from a coverage standpoint.

The comparison between next-generation MFA and legacy MFA comes down to a single question. What does an attacker need to defeat it? Legacy MFA adds a step to the login process. If that step produces a value that can be intercepted, forwarded or socially engineered out of a user, the step exists but the protection does not. Next-generation MFA is designed so there is nothing to intercept. The sections below cover each core weakness of legacy MFA and the next-generation property that eliminates it.

A single cyberattack can be devastating for any business but even more so for smaller businesses. In 2021, 46% of data breaches impacted small and medium (SMB) businesses. In addition, the average cost of a single breach against SMBs increased from $101K in 2020 to $105K in 2021. In contrast, the average breach cost for larger enterprises fell between 2020 and 2021. It is incredibly difficult for small businesses to recover from a data breach and within a year of a data breach, more than half of small businesses fail.

Enterprise cybersecurity is a war zone. Today, organizations face an ever-increasing number of cyber threats, from system intrusions and phishing scams, to ransomware attacks, web application attacks, and more – any of which can result in serious damage to enterprise assets and irreversible loss of data and intellectual property.