[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-multi-factor-authentication::en":3,"gloss-cluster-multi-factor-authentication::en":26,"gloss-next-multi-factor-authentication::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"multi-factor-authentication","security","Multi-Factor Authentication (MFA)","Multi-factor authentication requires more than one kind of evidence before granting access: something you know (a password), something you have (a device or security key), or something you are (a biometric). The point is that the second factor is expected to fail independently of the first, so a stolen password on its own is not enough. It remains the single highest-value control a SaaS product can offer, because credential reuse and phishing account for a large share of account takeovers. Not all second factors are equal, and the differences are practical rather than theoretical. SMS codes are the weakest common option: they can be intercepted by SIM-swap and are still phishable, because a user can be persuaded to read a code to an attacker in real time. Time-based one-time codes from an authenticator app remove the carrier from the picture but are equally phishable. Push approvals add fatigue attacks, where a user eventually accepts one of many prompts; number matching mitigates this. Hardware security keys and passkeys are the meaningfully different tier, because the credential is bound to the site's origin and cannot be replayed against a lookalike domain. For product teams the design questions are which actions re-prompt (login, adding a payout destination, changing recovery details), whether enforcement can be set organisation-wide by an administrator, and — most often overlooked — what the recovery path is, since a weak reset flow puts the whole scheme back at the level of the mailbox that receives it.","MFA requires a second, independently-failing factor beyond the password — how SMS, app codes, push and hardware keys differ, and why recovery is the weak point.",null,[11,14,17,20,23],{"slug":12,"name":13},"least-privilege","Principle of Least Privilege",{"slug":15,"name":16},"oauth","OAuth",{"slug":18,"name":19},"passkey","Passkey",{"slug":21,"name":22},"sso","Single Sign-On (SSO)",{"slug":24,"name":25},"zero-trust","Zero-Trust Architecture",[27,31,35,39,42,45,48,51,54,57,60,63],{"slug":28,"category":5,"name":29,"updated_at":30},"audit-log","Audit Log (Audit Trail)","2026-08-24T02:46:37+00:00",{"slug":32,"category":5,"name":33,"updated_at":34},"blast-radius","Blast Radius","2026-08-24T03:30:02+00:00",{"slug":36,"category":5,"name":37,"updated_at":38},"break-glass-access","Break-Glass Access","2026-08-24T02:46:38+00:00",{"slug":40,"category":5,"name":41,"updated_at":38},"bridge-letter","Bridge Letter",{"slug":43,"category":5,"name":44,"updated_at":38},"business-associate-agreement","Business Associate Agreement (BAA)",{"slug":46,"category":5,"name":47,"updated_at":30},"byok","Bring Your Own Key (BYOK)",{"slug":49,"category":5,"name":50,"updated_at":38},"cve","CVE (Common Vulnerabilities and Exposures)",{"slug":52,"category":5,"name":53,"updated_at":34},"data-classification","Data Classification",{"slug":55,"category":5,"name":56,"updated_at":38},"data-loss-prevention","Data Loss Prevention (DLP)",{"slug":58,"category":5,"name":59,"updated_at":38},"data-minimization","Data Minimization",{"slug":61,"category":5,"name":62,"updated_at":38},"data-poisoning","Data Poisoning",{"slug":64,"category":5,"name":65,"updated_at":38},"data-processing-agreement","Data Processing Agreement (DPA)"]