ConsultationMFA is necessary but not all methods are equal. Fatigue attacks target push notifications, and phishing kits target SMS OTP and some app methods.
Number matching, push rate limits, and lockouts after suspicious attempts harden fatigue resistance. Training users to deny unexpected prompts is essential.
Gradually moving privileged roles to FIDO2 yields the highest return. Admin accounts should not rely on SMS alone.
Send MFA deny/approve logs to SIEM. A wave of denials before a successful approval is a strong compromise signal.
For contractors and break-glass access, define separate short-lived MFA methods so exceptions do not become permanent holes.
In IAM projects Hoxy measures MFA coverage by method quality and fatigue metrics—not activation percentage alone.