Skip to content
ENExplore Calculators

MFA Security Calculator

Model how much account takeover multi-factor authentication actually prevents, given the method and your enrolment rate.

About MFA Security Calculator

MFA only protects the users who have it, so the block rate is multiplied by the enrolment rate — a 99 % factor at 78 % enrolment removes 77 % of risk, not 99 %. Targeted attacks degrade every shared-secret factor because a real-time phishing proxy relays the code, which is modelled here as a 20 % loss of effectiveness on the targeted share of attacks. It shows that the enrolment gap usually costs more risk than the choice of factor, so chasing the last 20 % of users beats upgrading the 80 % who are already covered.

Formula

MFA Security

effective reduction = method block rate × targeting factor × enrolment rate; takeovers with MFA = baseline takeovers × (1 − effective reduction).

block rate
Share of takeover attempts the factor defeats
targeting factor
1 − targeted share + 0.8 × targeted share

Worked example

With the default values below, MFA Security Calculator returns Effective Risk Reduction of 74.9%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Accounts in scopeaccepts 1–10,000,000 accounts
10,000 accounts
Annual takeover rate without MFAaccepts 0–100 %
1.2 %
MFA methodone of None — 0 %, Email magic link — 92 %, SMS one-time code — 96 %, Push prompt on device — 98 %, TOTP authenticator app — 99 %, FIDO2 security key or passkey — 100 %
TOTP authenticator app — 99 %
Users enrolledaccepts 0–100 %
78 %
Attacks that are targetedaccepts 0–100 %
15 %

Results

Effective Risk Reduction
74.9%
Takeovers per Year Without MFA
120.0 accounts
Takeovers per Year With MFA
30.1 accounts
Takeovers Prevented
89.9 accounts
Method Block Rate After Targeting
96.0%

Step by step

  1. 1Values used
  2. 2MFA Security
  3. 3Effective Risk Reduction= 74.9
  4. 4Takeovers per Year Without MFA= 120.0 accounts
  5. 5Takeovers per Year With MFA= 30.1 accounts
  6. 6Takeovers Prevented= 89.9 accounts
  7. 7Method Block Rate After Targeting= 96.0

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or fees or charges into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is MFA Security calculated?

effective reduction = method block rate × targeting factor × enrolment rate; takeovers with MFA = baseline takeovers × (1 − effective reduction). MFA only protects the users who have it, so the block rate is multiplied by the enrolment rate — a 99 % factor at 78 % enrolment removes 77 % of risk, not 99 %. Targeted attacks degrade every shared-secret factor because a real-time phishing proxy relays the code, which is modelled here as a 20 % loss of effectiveness on the targeted share of attacks.

Why does MFA Security matter?

It shows that the enrolment gap usually costs more risk than the choice of factor, so chasing the last 20 % of users beats upgrading the 80 % who are already covered.

What values do I need to enter?

This calculator takes 5 inputs: Accounts in scope, Annual takeover rate without MFA, MFA method, Users enrolled, Attacks that are targeted. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Which MFA method is actually phishing-resistant?

Only FIDO2 security keys and passkeys, because the credential is bound to the origin and cannot be replayed to a different site. SMS, TOTP and push prompts are all shared secrets or approvals that a real-time proxy or a fatigue attack can capture.

Where do the block rates come from?

The 2019 Google, NYU and UCSD study of real hijacking attempts measured on-device prompts blocking 100 % of automated bots and 99 % of bulk phishing, SMS codes 100 % and 96 %, and security keys 100 % across the board — with the figures dropping to 90 % and 76 % against targeted attacks.

Related Calculators

MFA Security Calculator – Calculate Effective Risk Reduction