Model how much account takeover multi-factor authentication actually prevents, given the method and your enrolment rate.
MFA only protects the users who have it, so the block rate is multiplied by the enrolment rate — a 99 % factor at 78 % enrolment removes 77 % of risk, not 99 %. Targeted attacks degrade every shared-secret factor because a real-time phishing proxy relays the code, which is modelled here as a 20 % loss of effectiveness on the targeted share of attacks. It shows that the enrolment gap usually costs more risk than the choice of factor, so chasing the last 20 % of users beats upgrading the 80 % who are already covered.
MFA Security
effective reduction = method block rate × targeting factor × enrolment rate; takeovers with MFA = baseline takeovers × (1 − effective reduction).
effective reduction = method block rate × targeting factor × enrolment rate; takeovers with MFA = baseline takeovers × (1 − effective reduction). MFA only protects the users who have it, so the block rate is multiplied by the enrolment rate — a 99 % factor at 78 % enrolment removes 77 % of risk, not 99 %. Targeted attacks degrade every shared-secret factor because a real-time phishing proxy relays the code, which is modelled here as a 20 % loss of effectiveness on the targeted share of attacks.
It shows that the enrolment gap usually costs more risk than the choice of factor, so chasing the last 20 % of users beats upgrading the 80 % who are already covered.
This calculator takes 5 inputs: Accounts in scope, Annual takeover rate without MFA, MFA method, Users enrolled, Attacks that are targeted. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Only FIDO2 security keys and passkeys, because the credential is bound to the origin and cannot be replayed to a different site. SMS, TOTP and push prompts are all shared secrets or approvals that a real-time proxy or a fatigue attack can capture.
The 2019 Google, NYU and UCSD study of real hijacking attempts measured on-device prompts blocking 100 % of automated bots and 99 % of bulk phishing, SMS codes 100 % and 96 %, and security keys 100 % across the board — with the figures dropping to 90 % and 76 % against targeted attacks.