MFA at login isn’t enough

MFA protects login, but critical business risk occurs in enterprise communications and workflows. Learn how Traceless brings identity verification into high-risk interactions.

Identity, MFA

The false sense of security around MFA

Multi-factor authentication (MFA) was introduced to mitigate credential-based attacks by enforcing multi-dimensional identity validation at login via something you know (password), something you have (device), or something you are (biometric). From a systems perspective, MFA strengthens the authentication boundary. However, modern architectures reveal a critical flaw:

Authentication is treated as a point-in-time event, while business trust decisions occur continuously across enterprise communications and workflows. Most cybersecurity breaches no longer target authentication—they target authenticated sessions and trusted workflows.

Real-world MFA bypass stories

Recent breaches show that attackers often exploit trusted business processes rather than technical authentication controls. In the Uber 2022 breach, a member of the LAPSUS$ group used stolen credentials and bombarded an employee with push notifications until one was approved, then called the employee while posing as IT to gain trust and establish access. In the MGM Resorts International 2023 attack, threat actors reportedly used publicly available LinkedIn information to impersonate an employee and convince the service desk to reset credentials, bypassing technical controls through human workflows. These incidents reflect a broader trend: Microsoft has reported thousands of password attacks per second and documented tens of thousands of token theft incidents per day, while CrowdStrike found that voice phishing surged 442% in late 2024 as attackers increasingly exploit valid identities rather than malware. The architectural implication is exactly what NIST Special Publication 800-207 (Zero Trust Architecture) emphasizes: trust should be continuously evaluated, not granted indefinitely after a single login event. In other words, MFA remains essential, but modern security requires verifying identity during sensitive actions such as password resets, payment approvals, and secure data exchanges.

The architectural flaw: session-based trust models

Most organizations use MFA to verify identity when someone signs in to a system. After that point, however, sensitive business requests often move through communication channels and operational workflows where identity is assumed rather than reverified.

A finance manager may receive updated wire instructions by email. An HR team may exchange tax documents with a new employee. A help desk agent may process a password reset request. A customer support representative may send confidential files to a client. In each of these situations:

1. A person has already authenticated to the tools they use
2. A high-risk request is communicated through email, chat, ticketing systems, or other business platforms
3. Employees must decide whether the person on the other end is legitimate
4. Sensitive actions are taken or sensitive information is shared

This is the core security gap: the most important trust decisions in a business happen inside communications and workflows, long after the initial login event.

Trust is granted too early

“Is this person making this sensitive business request right now actually who they claim to be?”

That question doesn’t happen at login. It happens inside communications and workflows. Even when MFA works perfectly, attackers still succeed. Here’s how and how Traceless can help:

Protect enterprise communications, authentication to continuous verification

Old Model:

Authenticate once → trust everything

Traceless Recommended Model:

Verify when it matters → trust only what’s verified

This means enabling organizations to trigger MFA and identity verification directly within enterprise communications and workflows.

How Traceless extends MFA into enterprise communications and workflows:

FAQ

Related content

case study

Prevent impersonation attacks

Start with one integration, validate quickly, and expand across your environment.