MFA is on the checklist of every audit I have ever seen, and the tick is where most thinking stops. It should not be. The NCSC's guidance is blunt about it: not all types of MFA are created equal. Text messages can be intercepted. A bare push notification can be spammed until someone taps approve at 11pm to make it stop. That is MFA fatigue, and it works because the approval asks nothing of the user except irritation. The better versions make phishing structurally harder: number matching, so the person must see the login screen to approve it, and passkeys or hardware keys, where there is no code to type into a fake page at all. If your MFA rollout ended at "any second factor counts", the project is not finished. The factor you chose is the control. https://www.ncsc.gov.uk/guidance/multi-factor-authentication-online-services #CyberSecurity #InfoSec #MFA