Adaptive MFA 2026: How Risk-Based Authentication Replaces Standard MFA

5 min Reading Time

79 percent of Business Email Compromise (BEC) victims had MFA correctly implemented – and were hacked anyway. The reason: Standard MFA is a one-time hurdle, worthless after token theft. Adaptive MFA evaluates every login attempt in real time and adjusts security levels based on current risk. NIS2 explicitly demands this: “continuous authentication solutions.” Here’s what lies behind it and how major vendors are implementing it.

TL;DR

• Microsoft blocks 600 million identity attacks daily – over 99 percent of them password-based. Only 41 percent of Entra Enterprise users are protected by MFA (Microsoft Digital Defense Report 2024).
• 79 percent of investigated BEC victims had MFA active – but were compromised via token theft (AiTM). Standard MFA is no longer sufficient (FRSecure Incident Response Report).
• NIS2 Art. 21(2)(j) explicitly mentions “continuous authentication solutions” – the normative foundation for Adaptive MFA beyond standard MFA.
• Microsoft Entra processes 40 TB of identity signals daily for risk-based access decisions (Microsoft Learn).
• Gartner forecasts: By 2027, over 90 percent of MFA transactions will be based on FIDO protocols (Passkeys) (Gartner Market Guide 2025).

How Adaptive MFA Differs from Standard MFA

Standard MFA prompts for the same second factor at every login – regardless of whether the user is accessing from their usual office PC or an unknown IP in another country. Adaptive MFA instead evaluates each authentication attempt in real time using contextual signals and dynamically adjusts the security level.

Signals the system analyzes: device type and status, location and IP reputation, time of day, user behavior, network context. A machine-learning model calculates a risk score that triggers three response levels:

The crucial difference: Standard MFA is a one-time barrier. Once bypassed (e.g., via AiTM token theft), the attacker has free access until session timeout. Adaptive MFA with Continuous Access Evaluation can revoke tokens in real time if the risk profile changes.

Microsoft Entra Conditional Access: The Market Standard

Microsoft’s Conditional Access is the most widely adopted Adaptive MFA implementation in the enterprise segment. According to Microsoft, the policy engine of Entra ID (formerly Azure AD) processes over 40 TB of identity signals per day.

The system calculates two separate risk scores: User Risk (likelihood the account is compromised) and Sign-in Risk (likelihood a specific login is unauthorized). Both scores influence access decisions.

Typical policy configurations in practice:

• Sign-in Risk “Medium” or “High”: Enforce MFA, even on known devices
• Non-compliant device: Block access entirely, regardless of user risk
• Trusted Location + Managed Device: No MFA required – the combination of network and device state serves as a trust anchor

Okta, Auth0 and Cisco Duo: The Alternatives

Okta Adaptive MFA (starting at $6 per user/month) analyzes devices, networks, locations, and user behavior. Its proprietary ThreatInsight engine leverages data from millions of authentications to detect attack patterns. Since Q4 2024, it also includes Identity Secure Posture Management, which can automatically enforce MFA for critical roles.

Auth0 (part of Okta since 2021, designed for customer identity scenarios) works with three defined risk signals: NewDevice (login from an unknown device within the last 30 days), ImpossibleTravel (geographically impossible login patterns), and UntrustedIP (suspicious IP from threat intelligence databases). Available only in the Enterprise plan.

Cisco Duo (in Duo Premier and Advantage editions) offers Risk-Based Factor Selection and Risk-Based Remembered Devices. Unique feature: Wi-Fi fingerprinting via the Duo Desktop App as an additional location signal. Duo also detects Push Harassment and Push Spray attacks as distinct risk signals.

“In 65 investigated BEC incidents, 79 percent of victims had correctly implemented MFA – and were still compromised because session tokens were stolen.”
– FRSecure Incident Response Report, 2025

NIS2 Requires “Continuous Authentication” – What This Means in Practice

NIS2 Article 21(2)(j) explicitly states: “the use of multi-factor authentication or continuous authentication solutions.” This is more than a recommendation. For the approximately 29,500 affected companies in Germany, it means: Standard MFA meets the minimum requirement, but Adaptive MFA with Continuous Evaluation aligns with the spirit of the law.

ENISA (the European Cybersecurity Agency) clarifies: MFA is mandatory for privileged accounts, system administration, and access to network and information systems. Personal liability for executives makes this a top-priority issue.

Why Standard MFA Fails Against AiTM Attacks

Adversary-in-the-Middle (AiTM) attacks deploy a proxy between the user and the login page. The user authenticates correctly – including MFA. The proxy captures the resulting session token. From that moment, the attacker holds a valid, authenticated session.

Microsoft reported 147,000 token replay attacks in one year – an 111 percent increase. The problem: Standard MFA is a one-time barrier. After successful authentication, no further checks occur until session timeout.

Adaptive MFA with Continuous Access Evaluation (CAE) breaks this pattern. The system continuously verifies whether the session still matches the original risk parameters. If location, device, or behavior changes, the session is immediately invalidated – not hours or days later.

Phishing-resistant MFA (FIDO2/Passkeys) goes a step further: credentials are domain-bound. A proxy cannot relay them because the cryptographic handshake only works with the genuine domain. AiTM attacks become structurally impossible.

Vendor Comparison: What the Major Platforms Offer

Practical Checklist: Implementing Adaptive MFA

1. Inventory assessment: Which systems currently use which authentication methods? Which privileged accounts rely only on password + SMS OTP?
2. Define risk policies: For which applications and user groups should step-up authentication apply? At minimum: admin access, cloud consoles, VPN.
3. Enable phishing-resistant factors: Use FIDO2 security keys or Passkeys as the primary factor for privileged accounts. Not just as an option – but as a requirement.
4. Activate Continuous Access Evaluation: In Entra ID: Enable CAE in Conditional Access policies. For others: Reduce token lifetime to the minimum.
5. Configure Impossible Travel: Every platform has thresholds for geographically impossible logins. Enable and adjust to realistic travel patterns.
6. Set up monitoring: Feed risk-based login events into your SIEM. Don’t just log suspicious patterns – trigger alerts. The SIT lesson applies here too.

Conclusion: Standard MFA Is Necessary, But Not Sufficient

MFA remains the single most effective measure against identity attacks – Microsoft estimates phishing-resistant MFA blocks over 99 percent of all password-based attacks. But standard MFA without risk assessment is vulnerable to token theft and AiTM attacks. Adaptive MFA closes this gap through continuous risk evaluation and dynamic security levels.

NIS2 makes the direction mandatory: “continuous authentication solutions” is written into the law. Anyone still using static MFA today meets the minimum requirement – but not the intent of the regulation. The first step: Activate Conditional Access or equivalent policies for the top 10 percent most privileged accounts. That takes half a day of configuration and addresses 80 percent of the risk.

Frequently Asked Questions

What’s the difference between Adaptive MFA and Standard MFA?

Standard MFA prompts for the same second factor at every login. Adaptive MFA evaluates the risk of each login attempt in real time (device, location, behavior) and dynamically adjusts the security level. At low risk, one factor may suffice; at high risk, stronger factors or blocking are triggered.

Is Adaptive MFA required under NIS2?

NIS2 Art. 21(2)(j) mentions “multi-factor authentication or continuous authentication solutions.” Standard MFA meets the minimum requirement, but “continuous authentication” points toward adaptive methods. ENISA specifies: MFA is mandatory for privileged accounts, system administration, and access to critical systems.

How much does Adaptive MFA cost?

Microsoft Entra Conditional Access is included in Entra ID P2 (starting at approx. 9 EUR/user/month). Okta Adaptive MFA costs $6/user/month. Cisco Duo offers risk-based authentication starting with the Advantage edition. For organizations already using Microsoft 365 E5 or Entra ID P2, Conditional Access is available at no additional cost.

Does Adaptive MFA protect against AiTM attacks?

Better than standard MFA, but not completely. Continuous Access Evaluation (CAE) can revoke stolen tokens in real time instead of waiting for session timeout. Full protection comes only from phishing-resistant factors (FIDO2/Passkeys), which are domain-bound and cannot be relayed by a proxy.

Which vendor is best for Adaptive MFA?

For Microsoft-centric environments, Entra Conditional Access is the natural choice (deepest integration, CAE). For multi-cloud/multi-vendor environments, Okta offers the broadest integration landscape. Cisco Duo excels in organizations already using Cisco infrastructure. CrowdStrike Falcon ITP works as an ITDR layer that orchestrates existing MFA providers.

Header Image Source: Pexels / cottonbro studio (px:5474295)

About the author: Tobias Massow

More articles by Tobias Massow