Identity security

MFA is not your last line of defense

2 min readHarshaVardhan Aakanti
Cover illustration: a sign-in form with an MFA code, and a stolen session cookie skipping past it straight to an active session.

For years the advice was simple: turn on MFA and you are safe. Leadership checked the box, auditors signed off, and everyone relaxed. In 2026 that advice is incomplete for most organizations, because attackers have largely stopped caring about passwords.

MFA protects the login. Attackers are skipping the login.

What I keep seeing from the SOC floor

The pattern is consistent, and it never touches a login page:

01 · INFECTInfo-stealer malware lands on a personal or unmanaged device.
02 · HARVESTIt grabs live session cookies and OAuth tokens, not only passwords.
03 · REPLAYThe attacker replays the session. No password prompt, no MFA challenge.

A stolen session cookie is a fully authenticated user. Most organizations have no detection for it, because from the identity provider's point of view nothing failed. There was no bad password and no denied push. The session simply kept working from somewhere new.

Why this slips past most controls

Most identity alerting is built around authentication events: failed logins, MFA fatigue, password sprays. Session replay produces none of those. The activity shows up later, in the application logs, as normal use by a legitimate account. If your detections only watch the front door, a replayed token walks straight past them.

What actually moves the needle

  • Shorten session lifetimes and use token binding wherever your applications support it, so a stolen token expires quickly or fails off the original device.
  • Detect session reuse from a new ASN, a new device fingerprint, or an impossible-travel pattern within the same session, not only across logins.
  • Treat info-stealer log monitoring as a core control. If your users' cookies are being sold, you want to know before they are used.
  • Revoke sessions during incident response, not just reset passwords. A password reset does nothing to a token that is already valid.

The point

MFA is not useless. It still stops a large share of credential attacks, and you should keep it. But if it is your last line of defense, you do not really have one. The useful question for a security team is not "what is our MFA adoption rate?" It is "would we notice if a valid session started working from somewhere it shouldn't?"