MFA Security Calculator
Model how much account takeover multi-factor authentication actually prevents, given the method and your enrolment rate.
Inputs
Block rates against bulk phishing, from the Google/NYU/UCSD account-takeover study.
Effective Risk Reduction
74.9%
Takeovers per Year Without MFA
120.0accounts
Takeovers per Year With MFA
30.1accounts
Takeovers Prevented
89.9accounts
Method Block Rate After Targeting
96.0%
Step by step
Values used
Accounts in scope = 10,000 accounts; Annual takeover rate without MFA = 1.20 %; MFA method = TOTP authenticator app — 99 %; Users enrolled = 78 %; Attacks that are targeted = 15 %
MFA Security
effective reduction = method block rate × targeting factor × enrolment rate; takeovers with MFA = baseline takeovers × (1 − effective reduction).
Effective Risk Reduction
= 74.9
Takeovers per Year Without MFA
= 120.0 accounts
Takeovers per Year With MFA
= 30.1 accounts
Takeovers Prevented
= 89.9 accounts
Method Block Rate After Targeting
= 96.0
How it works
MFA only protects the users who have it, so the block rate is multiplied by the enrolment rate — a 99 % factor at 78 % enrolment removes 77 % of risk, not 99 %. Targeted attacks degrade every shared-secret factor because a real-time phishing proxy relays the code, which is modelled here as a 20 % loss of effectiveness on the targeted share of attacks. It shows that the enrolment gap usually costs more risk than the choice of factor, so chasing the last 20 % of users beats upgrading the 80 % who are already covered.
Formula
MFA Security
effective reduction = method block rate × targeting factor × enrolment rate; takeovers with MFA = baseline takeovers × (1 − effective reduction).
- block rate
- Share of takeover attempts the factor defeats
- targeting factor
- 1 − targeted share + 0.8 × targeted share
Frequently Asked Questions
How is MFA Security calculated?
effective reduction = method block rate × targeting factor × enrolment rate; takeovers with MFA = baseline takeovers × (1 − effective reduction). MFA only protects the users who have it, so the block rate is multiplied by the enrolment rate — a 99 % factor at 78 % enrolment removes 77 % of risk, not 99 %. Targeted attacks degrade every shared-secret factor because a real-time phishing proxy relays the code, which is modelled here as a 20 % loss of effectiveness on the targeted share of attacks.
Why does MFA Security matter?
It shows that the enrolment gap usually costs more risk than the choice of factor, so chasing the last 20 % of users beats upgrading the 80 % who are already covered.
What values do I need to enter?
This calculator takes 5 inputs: Accounts in scope, Annual takeover rate without MFA, MFA method, Users enrolled, Attacks that are targeted. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Which MFA method is actually phishing-resistant?
Only FIDO2 security keys and passkeys, because the credential is bound to the origin and cannot be replayed to a different site. SMS, TOTP and push prompts are all shared secrets or approvals that a real-time proxy or a fatigue attack can capture.
Where do the block rates come from?
The 2019 Google, NYU and UCSD study of real hijacking attempts measured on-device prompts blocking 100 % of automated bots and 99 % of bulk phishing, SMS codes 100 % and 96 %, and security keys 100 % across the board — with the figures dropping to 90 % and 76 % against targeted attacks.
You might also need
- Authentication Health Score CalculatorCommonly used together
- Credential Stuffing Risk CalculatorCommonly used together
- OTP Lifetime CalculatorCommonly used together
- TOTP Validity CalculatorCommonly used together
- Password Entropy Score CalculatorAlso in Password Security
- Password Crack Time CalculatorAlso in Password Security