MFA Isn't Enough: Why You Need Identity Protection
Multifactor authentication has become the minimum security standard for any serious organization. If your company already uses MFA, you’re ahead of many others in the region. But if you think MFA is enough to protect your organization’s identities, you need to reconsider your position.
Attackers didn't stop trying to steal credentials when MFA was introduced. They evolved their techniques to circumvent it. And they're succeeding. This article explains why MFA, while essential, is just one piece of a much larger puzzle called identity protection.
How Attackers Bypass MFA
Session token theft: Once a user authenticates using MFA, the system generates a session token that keeps the connection active. Attackers can steal these tokens through malware, man-in-the-middle attacks, or by compromising the browser. With the token in hand, the attacker can access the system without having to re-authenticate.
MFA fatigue: Attackers send multiple MFA approval requests to the user's phone until the user, out of exhaustion or confusion, approves one. This technique has been used in high-profile breaches targeting major technology companies.
Real-time phishing via proxy: Tools like EvilGinx create proxy servers that intercept users’ credentials and MFA codes in real time, forwarding them to the attacker before they expire. The user believes they have logged in normally; in reality, the attacker is already inside.
Social engineering: Attackers call the user, posing as technical support, and convince them to share their MFA code or approve a legitimate authentication request generated by the attacker.
What Is Identity Protection, and Why Does It Go Beyond MFA?
Identity protection is a comprehensive approach that treats each user’s digital identity as a security perimeter in and of itself. It isn’t limited to verifying who you are at the time of login—it continuously monitors how, where, and when you access resources, and detects anomalies that could indicate your account has been compromised.
Continuous authentication: Instead of verifying identity just once at the start of a session, identity protection systems continuously assess risk throughout the session, taking into account factors such as location, device, time of day, and behavioral patterns.
Conditional access: Access policies dynamically adapt to the context. Access from a user’s usual corporate device at the office requires less verification than access from an unknown device in another country.
Detection of Compromised Credentials: Continuous monitoring of the dark web, data breach databases, and criminal forums to determine whether your employees' credentials have been exposed.
Privilege Management: The principle of least privilege is applied dynamically: each user has access only to what they need, and privileged access requires additional verification.
Why This Matters Especially in Latin America
In Latin America, where credential-based attacks are particularly prevalent and where many companies have not yet implemented conditional access policies or identity monitoring, the gap between having MFA and having true identity protection is enormous. Global data shows that more than 97% of identity attacks are brute-force or password-spray attacks, and that modern MFA can prevent more than 99% of them. But sophisticated attacks that bypass MFA—such as those described above—are the ones that cause the most costly breaches.
In terms of investigated incidents, identity weaknesses are found in nearly 90% of cases, and 65% of initial access attempts are driven by compromised identities. This makes it clear that identity is not just one component of security—it is the main battleground.
The Action Plan for IT Directors
If your organization already has MFA in place, the next logical step is to evolve toward a comprehensive identity protection strategy. This involves migrating to phishing-resistant MFA (such as passkeys or FIDO2 tokens), implementing risk-based conditional access policies, enabling continuous monitoring of identities and sessions, establishing a dedicated response process for identity compromises, and regularly auditing the access privileges of all users.
Pint Solutions implements identity protection strategies that go beyond MFA, tailored to the context and resources of companies in Latin America. Let's talk about how to strengthen identity security in your organization.