CISA Strongly Recommends Phishing-Resistant MFA

This blog post advocates for phishing-resistant MFA, highlighting that many common MFA methods (e.g., SMS, OTP, push) can be easily phished or bypassed and endorsing stronger options in line with recommendations from CISA, NIST, and major vendors. It recounts KnowBe4’s long-standing campaign—sparked by a 2018 Kevin Mitnick demo—to educate on MFA weaknesses, provides resources (webinars, tools, articles, and a book), and argues for prioritizing phishing-resistant MFA wherever possible while acknowledging continued risks and offering mitigation guidance.