How to Choose an MFA Solution in 2026: Buyer's Checklist
To choose an MFA solution in 2026, start from one property: can it make phishing-resistant authentication (passkeys and FIDO2 security keys) mandatory for the people who matter, across every login path you have? Then test recovery, session theft handling, coverage and price. Not all multi-factor authentication is equal, and a policy that only says "require MFA" is satisfied by methods that commodity phishing kits defeat daily.
Shortlist by situation (November 2026)
| Your situation | Start with | Ranking to read |
|---|---|---|
| Enterprise, mixed estate, needs broad coverage | Duo (Cisco), Microsoft Authenticator with Entra ID, RSA SecurID | Best MFA for enterprises |
| Phishing resistance is the requirement | Yubico, HYPR, Beyond Identity, 1Kosmos | Best phishing-resistant MFA |
| Already on a workforce IdP | Okta or Microsoft Entra ID native MFA | Okta vs Microsoft Entra |
| Banking and transaction signing | OneSpan | Best MFA solutions |
| Verification codes inside your own app | Twilio Verify (usage-priced) | What is passwordless |
| Want to self-host | Open-source options in top open-source MFA and passwordless tools |
For the whole field, see the top 10 MFA solutions for enterprises and Duo vs Microsoft Authenticator.
What MFA costs in 2026
Few MFA vendors publish a price: in SWI's Identity Pricing Transparency Index 2026, half of the 18 MFA vendors are quote-only. The published anchors, read 30 October 2026:
| Product | Published price | What the tier boundary hides |
|---|---|---|
| Duo | Free to 10 users; Essentials $3, Advantage $6, Premier $9 per user per month | Risk-Based Authentication and session theft protection start at Advantage |
| Microsoft Entra ID | P1 $7, P2 $10 per user per month, paid yearly | Sign-in and user risk policies require P2 (Microsoft Learn) |
| Okta Workforce | Starter $6, Essentials $17 per user per month, $1,500 annual minimum | Adaptive MFA is sold as its own SKU |
| Yubico | Published per-key hardware prices | Distribution, replacement and spare keys |
1. Prioritize phishing resistance
Phishing-resistant means origin-bound: the authenticator refuses to sign for a domain other than the one that registered the credential. Anything a human can read, type, or approve can be relayed. NIST SP 800-63B-4 treats manual-entry codes as not phishing resistant and requires verifiers to offer at least one phishing-resistant option at AAL2. The standard underneath, WebAuthn, became a Level 3 W3C Recommendation on 25 August 2026.
2. Choose the MFA device for each population
| MFA device | Phishing-resistant | Best for | Watch out for |
|---|---|---|---|
| FIDO2 security key (for example YubiKey) | Yes, device-bound | Admins, break-glass, shared workstations | Spares and lost-key process |
| Platform authenticator (Windows Hello, Touch ID, Android) holding a passkey | Yes | General workforce on managed devices | Synced passkeys fail AAL3's non-exportable key rule |
| Phone app with push | No | Broad coverage, legacy apps | Push bombing; require number matching |
| Authenticator app code (TOTP) | No | Fallback | Relay; cloud-synced seeds |
| Hardware OTP token | No | Environments without phones | Relay; token logistics |
| SMS or voice code | No | Last resort only | SIM swap, relay; Entra ID stops delivering SMS and voice on 1 February 2027 (the SMS off-ramp) |
3. Cover your whole estate
Modern web apps are easy. The hard parts are VPNs, legacy apps, desktop login, SSH, and service accounts. Confirm coverage where you actually need it, and check SaaS apps individually: in SWI's Phishing-Resistant MFA Support Matrix 2026, only 12 of 95 business SaaS apps let an admin require passkeys or security keys, so most enforcement has to happen at the identity provider. The MFA matrix tool lists app by app.
4. Decide how much risk-based policy you need
Risk-based or adaptive authentication steps up, allows or blocks based on device, location and behaviour (risk-based auth). It cuts prompts for routine sign-ins, but it decides when to ask, not how strong the answer is. Compare what each vendor scores, whether the signals reach your VPN and desktop login (Duo's Risk-Based Authentication does not cover Windows Logon or Unix, per its profile), and which tier includes it.
5. Interrogate enrolment and recovery
Most real bypasses target enrolment and reset rather than the factor:
- What proves identity at first enrolment, and can that proof be socially engineered?
- Can a user self-service a reset, and what does that path actually require?
- Does the recovery path fall back to SMS or email? If so, the account is as strong as SMS.
- Can help desk staff reset a factor, and what verifies the caller? This is the path Scattered Spider uses, and at MGM Resorts one help desk call led to Okta super administrator control (help desk social engineering).
6. Ask what the vendor does about session theft
MFA at the door does not help if the attacker arrives holding a session that already authenticated. The Mirage2FA campaign reached 4,532 organization domains between 2024 and 2026 without breaking a single factor: it captured the password and session cookie through legitimate Microsoft 365 login flows (adversary-in-the-middle phishing, pass-the-cookie). In 2026 another actor replayed stolen tokens into 79 organizations and replaced victims' MFA methods so access survived password resets. Ask about sender-constrained tokens such as DPoP (RFC 9449), Device Bound Session Credentials, session revocation APIs, alerts on factor changes, and CAEP support. As a practitioner estimate rather than a measured statistic, token theft is now the dominant bypass rather than factor compromise.
7. Check the vendor's own track record
Your MFA provider is part of your attack surface. In April 2024 an attacker phished the telephony provider that delivers Duo's SMS messages and downloaded message logs, and the 0ktapus campaign captured 5,441 MFA codes from users at more than 130 organizations (OTP relay). Ask each vendor for its disclosed incidents and CVEs for the last 24 months.
8. Tier your authenticators
Synced passkeys make consumer and workforce adoption possible. Device-bound hardware keys are what you want for administrators, break-glass accounts, and anyone with production access, especially after the August 2026 research on synced key custody. Choose a vendor that supports both classes and lets policy distinguish them.
9. Pilot with your hardest users
Run the pilot with administrators, remote staff and a legacy app, not with the IT team. Measure enrolment completion, help desk tickets per 100 users and how many accounts still have a phishable fallback after 30 days.
Where to start
Follow the MFA implementation guide and the MFA rollout guide, use the SSO-first playbook for enforcing phishing-resistant MFA, and browse MFA and passwordless vendors.
Frequently asked questions
- How do I choose an MFA solution?
- Pick one that supports phishing-resistant methods (passkeys and FIDO2 security keys) and lets policy require them, covers every login path you have including VPN and legacy apps, hardens enrollment and recovery, and handles session theft after login. Then compare price at your real user count and pilot with your hardest population, usually administrators and remote staff.
- What is the best type of MFA for an enterprise?
- Phishing-resistant MFA: FIDO2 security keys and passkeys. They are origin-bound, so the authenticator refuses to sign for any domain other than the one that registered the credential. SMS and basic one-time codes are better than nothing but can be phished, relayed, or defeated through SIM swaps. Write policy against that property rather than a generic require MFA rule.
- What is an MFA device?
- Any authenticator a user holds to prove the second factor: a FIDO2 security key such as a YubiKey, a laptop or phone acting as a platform authenticator for passkeys, a phone running an authenticator app for push or codes, or a hardware one-time-password token. Only security keys and passkeys are phishing-resistant; app codes, push and hardware OTP tokens can be relayed.
- What is risk-based or adaptive MFA?
- MFA that changes what it asks for based on signals such as device, location, IP reputation and user behaviour: allow, step up to a stronger factor, or block. It reduces prompts for normal sign-ins, but it is not a substitute for phishing-resistant factors. Check which tier includes it: Duo puts Risk-Based Authentication in Advantage at $6 per user per month, and Microsoft requires Entra ID P2 for sign-in and user risk policies.
- Can attackers bypass MFA without breaking the factor?
- Yes, and that is now the common case. Adversary-in-the-middle kits capture the password and the resulting session cookie, then replay the authenticated session. The Mirage2FA campaign reached 4,532 organization domains between 2024 and 2026 this way without breaking a single factor. Ask vendors about device-bound sessions, session revocation APIs, and continuous evaluation, not just the login step.
- Why do enrollment and account recovery matter when choosing MFA?
- Most real MFA bypasses target enrollment and reset rather than the factor itself. Ask what proves identity at first enrollment, what a self-service reset actually requires, whether recovery falls back to SMS or email, and how help desk staff verify a caller before resetting a factor. Help desk social engineering is the path Scattered Spider uses, so a strong factor with weak recovery is weak.
- Should we use synced passkeys or hardware security keys?
- Both, tiered by risk. Synced passkeys make broad workforce and consumer adoption practical. Device-bound hardware keys suit administrators, break-glass accounts, and anyone with production access, especially after the August 2026 research on synced key custody. NIST SP 800-63B-4 also requires a non-exportable key at AAL3, which synced passkeys do not meet.
- Is the MFA built into our IAM platform enough?
- Often, if your IAM platform covers everything you need to protect. Check coverage beyond modern web apps: VPNs, legacy applications, desktop login, and service accounts are the hard parts. Standalone MFA specialists are strongest for workforce passwordless and broad coverage across that estate, so the decision comes down to where your gaps actually are.
Related on Start with Identity
- GuideHow to Choose a PAM Solution in 2026: A Buyer's Checklist
To choose a PAM solution, count your standing privileged access first, decide whether you need vault-first PAM or infrastructure access, then test ownership, pa
- GuideHow to Choose an IAM Platform in 2026: A Buyer's Checklist
To choose an IAM platform, map your users, applications and their protocols first, then score candidates on lifecycle depth, admin security and honest three-yea
- GuideHow to Choose an ITDR Solution in 2026
To choose an ITDR solution, name the identity incident you would struggle most to survive, then test each shortlisted platform against your own attack scenarios
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- TemplateAccess Review Checklist
A practical checklist for running an access certification campaign that auditors accept and managers actually complete.
- BlogAttackers are phoning employees about their passkeys, then enrolling their own MFA method
Microsoft detailed a campaign running since May 2026 in which callers posing as IT tell US enterprise users to update their passkey or MFA settings, route them