# Is multi-factor authentication enough to stop account takeover?

It stops most of it, but not all. Multi-factor authentication (MFA) blocks attacks that rely on a stolen or guessed password alone, which is why insurers ask for it and NIS2 lists it among its measures. Attackers have adapted: they use fake login pages that relay the code in real time, steal the session cookie after login, flood users with push requests until one is accepted, or talk the help desk into resetting a phone. Raise the bar: prefer phishing-resistant methods such as passkeys or hardware security keys, especially for administrators and finance; use number matching on push prompts; limit how long sessions last; and make the help desk verify identity before resetting MFA. Watch sign-in logs for risky sign-ins. A network sensor does not see sign-ins. What NetSenX shows is what a taken-over account's device does next on the network, such as lateral movement, scanning or large uploads, on every plan.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/is-mfa-enough-to-stop-account-takeover

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Does a partial MFA rollout count for insurers and auditors?](https://netsenx.com/en/faq/does-a-partial-mfa-rollout-count)
- [Which MFA methods resist phishing?](https://netsenx.com/en/faq/which-mfa-methods-resist-phishing)
- [What is MFA fatigue, or push bombing?](https://netsenx.com/en/faq/what-is-mfa-fatigue-or-push-bombing)
- [Who holds admin rights in our company, and how do we check?](https://netsenx.com/en/faq/how-to-find-out-who-has-admin-rights)
- [What does least privilege mean in practice?](https://netsenx.com/en/faq/what-is-least-privilege-in-practice)