Why Organizations Are Moving Beyond Traditional MFA
Organizations have spent years deploying multi-factor authentication to reduce the risk of credential theft. While MFA remains a critical security control, not all MFA methods provide the same level of protection.
Attackers have adapted their techniques to bypass SMS codes, authenticator applications, and push notifications through phishing kits, adversary-in-the-middle attacks, session hijacking, and MFA fatigue campaigns.
FIDO2 was created specifically to address these weaknesses by providing phishing-resistant authentication that validates the service requesting authentication before access is granted.
Why Organizations Are Adopting FIDO2
- Phishing Resistant: Authentication requests are validated against the legitimate service before access is granted.
- Passwordless: Users can authenticate without entering or managing passwords.
- Hardware Backed: Cryptographic credentials remain protected inside trusted devices and security keys.
- Improved User Experience: Faster sign-ins with fewer password resets and support tickets.
Key Takeaways
- Traditional MFA can still be phished.
- FIDO2 validates the website requesting authentication.
- FIDO2 security keys provide strong phishing resistance.
- FIDO2 supports passwordless authentication.
- Many organizations deploy FIDO2 first for privileged users and administrators.
What Is FIDO2?
FIDO2 is an open authentication standard developed by the FIDO Alliance and supported by major technology vendors including Microsoft, Google, Apple, and many enterprise identity providers.
Rather than relying on shared secrets such as passwords or one-time codes, FIDO2 uses public-key cryptography. A private key remains securely stored on the authentication device while the corresponding public key is registered with the service being accessed.
During authentication, the device proves possession of the private key without exposing it to the service, the network, or the user.
Why Traditional MFA Is No Longer Enough
Traditional MFA significantly improves security over passwords alone, but many common methods still depend on users identifying fraudulent websites and authentication requests.
SMS Codes
- Vulnerable to SIM-swapping attacks.
- Codes can be entered into phishing websites.
- Susceptible to social engineering.
Authenticator Apps
- Users can still enter codes into fake websites.
- Real-time phishing kits can relay codes to legitimate services.
Push Notifications
- Susceptible to MFA fatigue attacks.
- Users may accidentally approve malicious requests.
FIDO2 eliminates these weaknesses by cryptographically validating the origin of the authentication request.
Authentication Security Maturity
Not all authentication methods provide the same level of phishing resistance. The maturity model below illustrates how organizations typically evolve from passwords and legacy MFA toward phishing-resistant authentication.
FIDO2 vs Traditional MFA
| Method | Passwordless | Phishing Resistant | Hardware Backed |
|---|---|---|---|
| SMS | No | No | No |
| TOTP | No | No | No |
| Push MFA | No | Partial | No |
| Passkeys | Yes | Yes | Device |
| FIDO2 | Yes | Yes | Yes |
Common FIDO2 Security Keys
Several vendors manufacture FIDO2-compatible security keys suitable for enterprise deployment. This list does not include all vendors.
Popular Enterprise FIDO2 Security Keys
- YubiKey – Widely adopted enterprise FIDO2 security key.
- Feitian – FIDO2 and smart card capable authentication devices.
- HID Crescendo – Enterprise identity and physical access solutions.
- Microsoft Security Key – Supported directly within Microsoft authentication ecosystems.
How FIDO2 Authentication Protects Against Phishing
A typical FIDO2 authentication event is simple for users while providing strong cryptographic protection behind the scenes.
The diagram above illustrates a standard FIDO2 authentication event. Unlike SMS codes, authenticator applications, and push notifications, the security key validates the origin of the authentication request before completing authentication.
If the request originates from a fraudulent website, the security key refuses to generate a valid response, preventing phishing attacks before credentials can be stolen.
Benefits of FIDO2
- Phishing resistance: Prevents authentication to fraudulent websites.
- Passwordless authentication: Eliminates password entry.
- Protection against MFA fatigue: No push approvals to spam.
- Reduced credential theft: Credentials never leave the device.
- Improved user experience: Faster authentication workflows.
- Reduced helpdesk burden: Fewer password resets and account lockouts.
Deployment Roadmap
Most organizations achieve the best results by rolling out phishing-resistant authentication in phases.
Phase 1: Administrators
Domain Admins, Entra Admins, Security Teams
Phase 2: Privileged Users
Finance, HR, Executives
Phase 3: Workforce
General user population
Where FIDO2 Fits Into a Modern Identity Strategy
FIDO2 is often one part of a broader identity modernization strategy that includes passwordless authentication, passkeys, conditional access policies, and phishing-resistant MFA initiatives.
Organizations that still rely heavily on Active Directory, VPNs, Remote Desktop, and legacy applications often combine FIDO2 with broader passwordless authentication platforms to secure both modern and legacy workflows.
For additional guidance, see our articles on Phishing-Resistant MFA Explained and Passwordless Authentication for Active Directory.
Final Thoughts
Traditional MFA remains better than passwords alone, but modern threats increasingly target MFA workflows directly. FIDO2 was specifically designed to address these weaknesses and is rapidly becoming the standard for phishing-resistant authentication.
Organizations evaluating identity modernization initiatives should strongly consider FIDO2 as part of a broader passwordless authentication strategy.