Skip to content
Calcrivo

MFA Security Calculator

Model how much account takeover multi-factor authentication actually prevents, given the method and your enrolment rate.

Inputs

accounts
%

Block rates against bulk phishing, from the Google/NYU/UCSD account-takeover study.

%
%

Targeted phishing with a real-time proxy defeats shared-secret factors far more often.

Effective Risk Reduction

74.9%

Takeovers per Year Without MFA

120.0accounts

Takeovers per Year With MFA

30.1accounts

Takeovers Prevented

89.9accounts

Method Block Rate After Targeting

96.0%

Step by step

  1. Values used

    Accounts in scope = 10,000 accounts; Annual takeover rate without MFA = 1.20 %; MFA method = TOTP authenticator app — 99 %; Users enrolled = 78 %; Attacks that are targeted = 15 %

  2. MFA Security

    effective reduction = method block rate × targeting factor × enrolment rate; takeovers with MFA = baseline takeovers × (1 − effective reduction).

  3. Effective Risk Reduction

    = 74.9

  4. Takeovers per Year Without MFA

    = 120.0 accounts

  5. Takeovers per Year With MFA

    = 30.1 accounts

  6. Takeovers Prevented

    = 89.9 accounts

  7. Method Block Rate After Targeting

    = 96.0

How it works

MFA only protects the users who have it, so the block rate is multiplied by the enrolment rate — a 99 % factor at 78 % enrolment removes 77 % of risk, not 99 %. Targeted attacks degrade every shared-secret factor because a real-time phishing proxy relays the code, which is modelled here as a 20 % loss of effectiveness on the targeted share of attacks. It shows that the enrolment gap usually costs more risk than the choice of factor, so chasing the last 20 % of users beats upgrading the 80 % who are already covered.

Formula

MFA Security

effective reduction = method block rate × targeting factor × enrolment rate; takeovers with MFA = baseline takeovers × (1 − effective reduction).

block rate
Share of takeover attempts the factor defeats
targeting factor
1 − targeted share + 0.8 × targeted share

Frequently Asked Questions

How is MFA Security calculated?

effective reduction = method block rate × targeting factor × enrolment rate; takeovers with MFA = baseline takeovers × (1 − effective reduction). MFA only protects the users who have it, so the block rate is multiplied by the enrolment rate — a 99 % factor at 78 % enrolment removes 77 % of risk, not 99 %. Targeted attacks degrade every shared-secret factor because a real-time phishing proxy relays the code, which is modelled here as a 20 % loss of effectiveness on the targeted share of attacks.

Why does MFA Security matter?

It shows that the enrolment gap usually costs more risk than the choice of factor, so chasing the last 20 % of users beats upgrading the 80 % who are already covered.

What values do I need to enter?

This calculator takes 5 inputs: Accounts in scope, Annual takeover rate without MFA, MFA method, Users enrolled, Attacks that are targeted. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Which MFA method is actually phishing-resistant?

Only FIDO2 security keys and passkeys, because the credential is bound to the origin and cannot be replayed to a different site. SMS, TOTP and push prompts are all shared secrets or approvals that a real-time proxy or a fatigue attack can capture.

Where do the block rates come from?

The 2019 Google, NYU and UCSD study of real hijacking attempts measured on-device prompts blocking 100 % of automated bots and 99 % of bulk phishing, SMS codes 100 % and 96 %, and security keys 100 % across the board — with the figures dropping to 90 % and 76 % against targeted attacks.

You might also need