Which MFA methods resist phishing?

Passkeys and hardware security keys based on the FIDO2 standard, and smart cards with certificates. They resist phishing because the key checks the web address it is talking to and will not answer a fake site, so there is no code for the user to type into the wrong place. Authenticator apps with number matching are a solid second choice; codes sent by text message and plain approve-or-deny push prompts are the weakest, because a convincing fake page or a tired user can hand them over. Start with the accounts that matter most: administrators, finance, executives and anyone with access to backups or customer data. Keep a spare key per person and a documented recovery procedure, so that a lost key does not lead to a hurried, insecure reset. MFA lives in your identity provider, not in the network. NetSenX does not see sign-ins; it shows what devices do on monitored segments after any account is used.

← All 45 questions on Zero trust, identity and segmentationAll topics