Phishing-resistant MFA: The new compliance baseline

DORA and NIS2 require phishing-resistant MFA — are you ready

Cybersecurity regulations are converging on a clear message: phishing-resistant multi-factor authentication (MFA) is now the baseline for compliance.

Whether you operate in financial services, critical infrastructure, healthcare, or any regulated sector, regulators are making it clear that weak authentication methods (like passwords or SMS codes) can no longer protect sensitive systems or pass audits.

Why phishing-resistant MFA matters

Traditional MFA methods, such as SMS one-time codes or knowledge-based questions, remain vulnerable to phishing and credential theft.
Phishing-resistant MFA, based on standards like FIDO2/WebAuthn, protects against these threats by ensuring authentication factors cannot be intercepted, replayed, or socially engineered.

For organizations, this means:

  • Meeting compliance requirements without relying on fragile stopgaps
  • Reducing the risk of credential-based breaches
  • Lowering operational costs linked to password resets and account recovery
What is DORA? Who does it apply to? What are the requirements? organizations?

What the regulations say

Several major regulatory frameworks have set phishing-resistant MFA as a core requirement:

  • DORA (Digital Operational Resilience Act, EU) – In force since Jan 2023, applicable from Jan 17, 2025. Requires financial entities to implement strong, resilient ICT security controls, including phishing-resistant authentication. Source: European Commission
  • NIS2 Directive (EU) – Effective Oct 18, 2024. Requires operators of essential and important entities to enforce robust access controls and MFA resistant to common attack vectors. Source: European Commission
  • PCI DSS 4.0 (Global) – Effective from March 31, 2025. Specifies that MFA for administrative and remote access must use methods resistant to phishing and credential replay attacks. Source: PCI Security Standards Council
  • OMB Memo M-22-09 (US Federal) – Issued Jan 26, 2022, mandates phishing-resistant MFA for federal agencies under the Zero Trust Strategy. Source: The White House

Together, these frameworks establish a new baseline: phishing-resistant MFA everywhere, including legacy and mission-critical systems.

The challenge of legacy systems

Many organizations struggle to deploy modern authentication across legacy or custom applications. These systems were never designed to support modern standards, yet regulators make no exceptions.

This creates a common dilemma:

  • How to implement phishing-resistant MFA everywhere without rewriting legacy apps or replacing existing IAM infrastructure.

How Secfense helps

This is where Secfense comes in.

Secfense provides a no-code MFA and passwordless layer that can be deployed across all applications, modern and legacy, without modifying source code. With Secfense, organizations can:

  • Enforce phishing-resistant MFA (passkeys, FIDO2/WebAuthn) across every app
  • Deploy gradually, starting with high-risk systems
  • Maintain business continuity with zero disruption to users
  • Centralize authentication policies and audit logs for regulatory reporting

Explore how Secfense helped BNP Paribas and UNIQA deploy phishing-resistant authentication at scale, without rewriting a single application.

Data Protection Officer Guide

Conclusion

Phishing-resistant MFA is no longer a “best practice.” It is the new compliance baseline.
Organizations that continue relying on passwords or SMS-based MFA face growing risks: not just of breaches, but of non-compliance penalties, failed audits, and regulatory action.

Secfense enables a secure, compliant path forward by bridging the gap between modern MFA requirements and the reality of legacy infrastructure.

Next step: Schedule a call with our team to see how Secfense can help your organization meet phishing-resistant MFA requirements without disruption.

👉 Schedule a call with Secfense

Featured Articles

Keep In Touch

Read More

Phishing-resistant MFA: The new compliance baseline

Cybersecurity regulations are converging on a clear message: phishing-resistant multi-factor authentication (MFA) is now the baseline for compliance. Whether you operate in financial services, critical…
Avatar of Antoni Sikora Antoni Sikora

READ TIME 3 MIN

Passkeys in regulated industries: IAM compliance without passwords

Regulated industries such as banking, healthcare, and public administration face stringent identity and access management (IAM) requirements driven by regulations including PSD2, HIPAA, NIS2, and…
Avatar of Antoni Sikora Antoni Sikora

READ TIME 4 MIN

Migrating IAM systems to support passkeys: challenges and solutions

Modernizing identity and access management (IAM) to enable passkeys is shifting from “nice to have” to a competitive necessity for enterprises. As identity-based attacks and…
Avatar of Antoni Sikora Antoni Sikora

READ TIME 4 MIN

Testimonials

We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that the User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.

Krzysztof Słotwiński

Business Continuity and Computer Security Officer

BNP Paribas Bank Poland

As part of the pre-implementation analysis, we verified that users utilize a wide range of client platforms: desktop computers, laptops, tablets, smartphones, and traditional mobile phones. Each of these devices differs in technological advancement, features, and level of security. Because of this, and also due to the recommendation of the Polish Financial Supervision Authority (UKNF), we decided to introduce additional protection in the form of multi-factor authentication mechanisms based on FIDO. As a result, users of our applications can log in safely, avoiding common cyber threats such as phishing, account takeover, and theft of their own and their clients’ data.

Marcin Bobruk

CEO

Sandis

We are excited to partner with Secfense to enhance our user access security for our web apps. By integrating their User Access Security Broker, we ensure seamless and secure protection for our applications and systems, delivering superior security and convenience to our customers.

Charm Abeywardana

IT & Infrastructure

Visium Networks

Before investing in Secfense, we had the opportunity to talk to its existing clients. Their reactions were unanimous: wow, it’s so easy to use. We were particularly impressed by the fact that implementing their solution does not require the involvement of IT developers. It gives Secfense a huge advantage over the competition, and at the same time opens the door to potential customers who so far were afraid of changes related to the implementation of multi-factor authentication solutions.

Mateusz Bodio

Managing Director

RKKVC

Even when the network and infrastructure are secured enough, social engineering and passwords can be used to gain control of the system by attackers. Multifactor authentication is the current trend. Secfense addresses this and allows you to build zero trust security and upgrade your current systems to passwordless applications within minutes, solving this problem right away,” said Eduard Kučera, Partner at Presto Ventures and cybersecurity expert – former Director in hugely successful Czech multinational cyber security firm Avast.

Eduard Kučera

Partner

Presto Ventures

One of the biggest challenges the world is facing today is securing our identity online. That’s why we were so keen to have Secfense in our portfolio. They make it possible to introduce strong authentication in an automated way. Until now, organizations had to selectively protect applications because the deployment of new technology was very hard, or even impossible. With Secfense, the implementation of multi-factor authentication is no longer a problem, and all organizations can use the highest standards of authentication security.

Stanislav Ivanov

Founding Partner

Tera Ventures