MFA Isn’t Enough Anymore. Here’s What’s Replacing It.

MFA Isn’t Enough Anymore. Here’s What’s Replacing It.

A plain-English guide to phishing-resistant authentication for Colorado small businesses

ViaTek | Lafayette, Colorado | (303) 664-1182 | viatek.net

A quick note before we get into it: the content here is longer than our usual posts, and it gets into some technical territory. We could have made it shorter, but this topic is a bit more complicated and needs more explanation than usual. If you run a business, these concepts are going to come up this year whether you are ready or not. We would rather take an extra ten minutes to explain it properly versus sending you into a cyber insurance renewal or security review with half the picture.

TL;DR

Old MFA (the text message code, the push notification you tap) is no longer enough. Attackers have figured out how to steal the session token your computer uses after you approve the prompt, and once they have the token, they are signed in as you. The fix is called phishing-resistant MFA, built on passkeys and a technology called FIDO2. For a typical Colorado small business, the stack looks like this: Keeper Enterprise for your main passkey vault, Microsoft Authenticator as a backup for your Microsoft 365 accounts, and Windows Hello for Business on every company computer. If you have an on-premises server, a newer Microsoft approach called Cloud Kerberos Trust ties it all together without the old certificate headaches. If you don’t, we can build it into Microsoft 365 directly. Total cost for a 25-person company: under $2,000 in year one. Average cost of a successful account takeover: $10,000 and up.

The numbers that should worry you

In 2023 alone, Microsoft’s Entra team detected 147,000 token replay attacks, a 111% increase over 2022. The 2024 Microsoft Digital Defense Report tracked a separate 146% rise in adversary-in-the-middle phishing attacks, the kind that trick you into completing MFA on a fake login page so the attacker can grab your session token on the way through. And Obsidian Security’s 2025 SaaS Threat Report found that MFA failed to prevent the attack in 84% of the incidents they investigated.

MFA is no longer the finish line. It is the starting line, and the attackers already jumped it.

How attackers are getting past your MFA

You already know how standard MFA works. You sign in with your password, your phone buzzes, you tap approve, and you are in. Or you get a text with a six-digit code and now you have to get out your phone and type the digits into your computer before the timer runs out. For years that was good enough. Now it is not, and the reason why is simpler than it sounds.

When you approve an MFA prompt, Microsoft hands your computer a little digital permission slip called a session token. That token says, "this person is verified, let them in without asking again for a while." It is why you do not have to re-authenticate every time you open Outlook.

Attackers figured out that if they can steal the token, they do not need your password or your MFA code. They just copy the token onto their own machine, and they are signed in as you. No prompts. No alarms. No second factor to bother with.

They get the token in a few ways:

• Adversary-in-the-middle phishing. A fake login page that looks exactly like Microsoft’s, run by tools with names like EvilProxy and Tycoon 2FA. You sign in normally, your real credentials and MFA code go to Microsoft through the fake page, and the attacker pockets the token on the way through.
• Malware on the endpoint. Infostealer malware rips tokens straight out of the browser while you are using it.
• MFA fatigue. They spam you with push notifications until you tap approve just to make it stop.

This is not theoretical. In the Travelers v. ICS case, Travelers went to court to rescind a cyber policy entirely after discovering the insured had misrepresented its MFA use on the application. The company faced a ransomware attack with no coverage to fall back on. In the AT&T/Snowflake breach, attackers used stolen credentials to sit inside AT&T’s Snowflake environment for 11 days, stealing call and SMS records for nearly 110 million customers. Scattered Spider tricked MGM’s help desk into resetting MFA for a privileged account, causing roughly $100 million in damage. And Okta’s own support system was compromised when attackers stole session tokens that let them bypass MFA for downstream customers like 1Password and Cloudflare. Coalition’s 2025 Cyber Claims Report found that 60% of all claims stemmed from email compromise and funds transfer fraud, exactly the kinds of attacks that proper MFA prevents. Token theft and MFA bypass are how the big breaches happen now.

If you are reading those names and thinking "we are not AT&T or MGM, nobody is coming after us," here is the part that might change your mind.

Verizon’s 2025 Data Breach Investigations Report tracked 3,049 security incidents at small and medium businesses. Of the confirmed breaches, 88% involved ransomware. That is more than double the rate at large companies. A third of those breaches started with stolen credentials, the exact thing a passkey makes useless.

Mastercard surveyed more than 5,000 small business owners in 2025 and found that 46% had already experienced a cyberattack. Nearly one in five of the ones that got hit went bankrupt or closed. Not "had a bad quarter", they went out of business. And only 23% said they were satisfied with their prevention plan. The FBI’s Internet Crime Complaint Center reports that business email compromise has cost organizations $55 billion since 2013, and their bulletin specifically notes that the scam "continues to target small local businesses."

The attackers are not picking targets based on company size. They are picking them based on who has the weakest front door. For a 15-person company with no MFA on their admin accounts, that front door is wide open.

The good news is there is something better, and while it does mean a change in how you do things, it is not that difficult. In fact, once in place, it is much easier than the old paradigm.

What "phishing-resistant" actually means

"Phishing-resistant MFA" is a term you are going to see on cyber insurance questionnaires, compliance audits, and Microsoft admin alerts this year. Here is what it means without the acronym soup.

A regular MFA code can be typed into a fake site. A push notification can be tapped on the wrong prompt. A text message can be intercepted. All three of those can be phished.

A phishing-resistant credential cannot. It is cryptographically tied to the real website. Before it hands anything over, it checks the actual domain you are talking to. If the domain is fake, it fails and the sign-in stops dead. There is no prompt to accidentally tap, no code to accidentally type. The credential physically refuses to work on the wrong site.

There are a few ways to get this kind of credential:

• Hardware security keys like YubiKey. A small USB or NFC device you tap to sign in.
• Passkeys. The same cryptographic approach as a hardware key, but stored in software on a phone, in a password manager, or built into your computer.
• Windows Hello for Business. Microsoft’s version for corporate Windows machines, which ties the credential to your device’s security chip and unlocks it with your face, fingerprint, or a PIN.

All three are built on the same open standard, called FIDO2. The difference is where the credential lives and how you unlock it. For most Colorado small businesses, the right answer is a combination of the three, and the way you combine them is where things get interesting.

The stack we recommend (and why)

Most guides on this topic read like a Microsoft product brochure. They will tell you to turn on Windows Hello, enable the Authenticator app, and call it a day. That works until someone loses their phone, gets a new laptop, or signs into a client’s conference room PC. Then it falls apart.

The approach we recommend for our clients has three layers. Each layer covers what the others cannot.

Layer 1: Keeper as the cross-platform passkey vault

Passkeys have a problem that nobody in the marketing materials wants to talk about. They are usually locked to a single ecosystem. Create a passkey in iCloud Keychain and it lives on your iPhone and Mac. Create one in Chrome on Windows and it lives in Google Password Manager. Create one in Microsoft Authenticator and it lives on that specific phone, nowhere else.

If your office manager has an iPhone, a Windows desktop, and an Android tablet, the passkey story falls apart fast. Which ecosystem gets the real credential? What happens when she switches devices? How do you share a vendor login with the bookkeeper?

Keeper solves this by acting as the passkey vault itself. The passkey you create inside Keeper works on every device Keeper runs on, which is basically all of them: Windows, macOS, iOS, Android, Chrome, Edge, Firefox, and Safari. Sign in anywhere, your passkey follows you. Lose your phone, your passkeys are still safe in the vault because Keeper uses zero-knowledge encryption, which means even Keeper can’t see what is inside.

A few reasons Keeper makes sense for small businesses specifically:

• Shared vaults. Your office manager and your bookkeeper both need the QuickBooks login. A shared Keeper vault lets them both access it without emailing passwords or writing them on a sticky note.
• Cloud recovery. If an employee’s phone falls in a lake, her passkeys are not gone with it. She logs into Keeper on her replacement phone and picks up where she left off. Device-bound passkeys do not give you this.
• Compliance-friendly. Keeper carries SOC 2, HIPAA, and FedRAMP certifications, which matters any time you get audited.
• MSP-friendly licensing. We can provision, manage, and offboard Keeper for your whole team from a central console. When someone leaves the company, their access is gone in seconds, not hours.

Keeper is the main vault. Think of it as the filing cabinet that holds all the keys to your digital life, and every device in your business knows how to open that one cabinet.

Layer 2: Microsoft Authenticator as the built-in backup

Keeper is where most of your passkeys should live, but Microsoft 365 has its own passkey implementation through the Authenticator app, and it is worth enabling for a specific reason: it is device-bound.

A device-bound passkey sounds like a downside at first. The passkey only works on the phone where it was created. It does not sync to iCloud, Google, or Keeper. If you lose the phone, that specific passkey is gone with it.

Here is why that’s a feature. A device-bound credential gives Microsoft the strongest possible proof that the person signing in is holding the exact physical phone you registered with the account. There is no way to export it, copy it, or get phished into handing it over. For your highest-risk accounts, like your C-Suite your finance team, that extra guarantee matters.

The play we recommend looks like this. Your daily-driver passkey lives in Keeper because you need it to work across every device you touch. Your backup for Microsoft 365 specifically lives in Microsoft Authenticator on your phone because it gives you a second path to get into your account if something ever happens to your primary vault. If you get locked out of one, the other still works.

The Authenticator app is free from Microsoft, it plays cleanly with every M365 Conditional Access policy we want to apply, and it satisfies the phishing-resistant MFA requirement for compliance. The one gotcha is that Microsoft Authenticator passkeys only work for Entra ID accounts, meaning your Microsoft work account. They do not protect your logins for third-party websites. That is exactly why you also need Keeper.

Layer 3 (not all of these have to be implemented at once): Windows Hello for Business on the computer itself

The third layer is the one most Colorado small businesses haven’t heard of, and it is the one that quietly makes the whole system work at the office every day.

Windows Hello for Business turns your work computer itself into a phishing-resistant credential. Your face, fingerprint, or PIN unlocks a cryptographic key stored in the computer’s security chip (called a TPM). That key signs you into Windows, into Microsoft 365, into OneDrive, into Teams, and into anything else connected to your company’s Microsoft tenant. One gesture at the start of the day and you are signed in to everything you need.

This is different from the consumer Windows Hello you might have set up at home. Business-grade Windows Hello for Business, which most people shorten to WHfB, requires specific setup, specific licensing (Microsoft 365 Business Premium covers it), and a decision about how it connects to the rest of your environment.

For most of our clients, that decision comes down to one question: do you still have an on-premises Active Directory server, or are you fully in the cloud?

If you are fully in the cloud, setup is simple. Windows Hello for Business registers with Entra ID, and you are basically done.

If you still have an on-premises domain controller (meaning you have a physical or virtual server running Active Directory, which is common for businesses with file shares, older line-of-business apps, or print servers), you are what Microsoft calls a "hybrid" environment. In a hybrid setup, Windows Hello needs to sign you into the cloud side (Entra ID, Microsoft 365) and the on-prem side (your file server, your internal apps) at the same time. That used to be painful. It involved setting up a certificate authority, issuing certificates to every user, and maintaining the whole thing forever.

It is not painful anymore, and this is where the quiet breakthrough happens.

Cloud Kerberos Trust: the fix that makes hybrid painless

Microsoft now recommends something called Cloud Kerberos Trust as the default deployment model for hybrid environments. Here is what it does in plain English. Your on-premises Active Directory trusts Entra ID to vouch for the user. When you sign into your laptop with Windows Hello, Entra issues a ticket that your local domain controller accepts as proof of who you are. You get single sign-on to your cloud apps and your on-premises file shares, and you never typed a password.

What makes Cloud Kerberos Trust the right choice for small businesses:

• No certificate authority to build or maintain. The older hybrid deployment models (Key Trust and Certificate Trust) both required you to stand up and run PKI infrastructure. Cloud Kerberos Trust does not.
• Immediate single sign-on. Sign in at the login screen, and you have instant access to your on-prem file shares. The older methods sometimes had a noticeable sync delay.
• Requirements most SMBs already meet. You need Windows 10 version 21H2 or newer, TPM 2.0 (every business-grade machine from the last five years has one), Entra Connect for identity sync, and a specific patch level on your domain controllers. We can check all of this in about fifteen minutes.

A couple of honest gotchas worth knowing before you get excited:

• Cloud Kerberos Trust does not cover RDP (Remote Desktop) sign-in or VPN authentication (although we recommend Tailscale, which does use Microsoft 365 SSO, you are covered there) out of the box. Those have separate solutions we can put in place.
• Your domain controllers need to be patched. If you are still running Server 2012 (we see it more than you would think), this is the push you needed to upgrade.
• Legacy apps that authenticate using NTLM may not work with Windows Hello. This is rare in 2026, but worth auditing before you flip the switch.

For the Colorado businesses we work with that still have a server room, Cloud Kerberos Trust is the single biggest upgrade to daily IT they have seen in a decade. People stop typing passwords. Help desk tickets for forgotten passwords drop to near zero. Sign-in takes about a second and a half.

What this costs

A reasonable question: if this is so much better, why is not everyone doing it already? The short answer is that it is a paradigm shift and paradigm shifts can seem expensive. The longer answer is that the cost is actually smaller than most people think.

For a 25-person Colorado business already on Microsoft 365 Business Premium:

• Microsoft Authenticator. Free. Already included.
• Windows Hello for Business. Included with Business Premium and F1. Users with Business Basic or Standard need an Entra P1 and Intune subscription added on.
• Cloud Kerberos Trust setup. A one-time configuration of your domain controllers and Entra Connect. For most environments, a few hours of work.
• Keeper Enterprise (through ViaTek). $5.00 per user per month, billed monthly through us. Keeper does not publish fixed Enterprise pricing on their site because they require a custom quote, but direct pricing typically lands between $5.00 and $7.00 per user per month depending on your seat count and contract length. Through ViaTek, you get it at the low end of that range with monthly billing flexibility and we handle provisioning, onboarding, and offboarding for you. For 25 users, that is $1,500 a year.
• Optional YubiKeys for admin accounts. $50 to $75 per key, one-time purchase. We recommend two per admin account so there is always a backup.

All in, a 25-person business can get to phishing-resistant MFA across the whole team for about $2,000 in year one, with ongoing costs around $125 a month. Compared to the average cyber insurance deductible after a successful account takeover (which starts at $10,000 and goes up fast from there), the math is not complicated.

"But what if someone is sitting at my computer?"

This is the first question we get when we explain passkeys to a team, and it is a fair one. If a passkey lives on your computer, what stops someone from walking up and using it?

The answer: your passkey is locked inside a vault, and that vault does not open without you. When you click "sign in with passkey," your password manager (Keeper, in our case) also needs authentication.

Think of it like this. Your office building has a front door with a key card. Your office inside has a lock. And the filing cabinet where you keep the sensitive stuff has its own combination. A passkey in a vault is the filing cabinet. Even if someone gets into the building and past your office door, they still can’t open the cabinet without the combination.

What about the gap? You are right that if someone has full access to your unlocked computer AND your vault is unlocked, they are in. The rule has not changed: lock your computer when you walk away. The difference now is that locking your screen is basically the only thing left to worry about.

So what does a passkey actually protect me from? The stuff that is way more likely to happen to you than someone breaking into your office. Someone sends you a fake Microsoft login page, and you type in your password without realizing it. Phishing is the most common way accounts get stolen. A passkey flat out refuses to work on a fake site. The math behind it checks the website address before it sends anything, and if the address is wrong, nothing happens. There is nothing for the attacker to grab.

Passkeys also protect you from data breaches. When a company gets hacked and millions of passwords are leaked online, yours is not in the pile. Passkeys do not store anything useful on the server side. Only the public half of the key lives there, and that half is useless without your device.

What to do next

If you are already a ViaTek client, this is on the roadmap for your environment. We will be talking with you about it, and then, hopefully, rolling it out in order of risk, starting with admin accounts and finance teams, then moving through the rest of the company over the next couple of quarters. Expect to hear from us.

If you are not a ViaTek client, here is the short version you can hand to whoever runs your IT:

1. Audit which of your accounts still use SMS or app-based push for MFA. Those are the ones at risk.
2. Turn on Windows Hello for Business for all company-owned Windows devices.
3. If you have an on-premises Active Directory, deploy Cloud Kerberos Trust instead of the older methods.
4. Roll out Keeper Enterprise (or an equivalent cross-platform passkey vault) to every employee.
5. Require Microsoft Authenticator passkeys on admin and finance accounts as a second factor.
6. Block legacy authentication at the Entra ID level so nothing can sneak in through the old front door.

It is a lot, but none of it is hard if someone who has done it before is guiding the rollout. And if your current MSP is still telling you "MFA is enough," you might want to ask them when they last read a Microsoft security bulletin.

We will walk you through it

At ViaTek, we do not push security upgrades because they make our month-end numbers look good. We push them because we have seen what happens when a client waits too long. Token theft is happening to Colorado businesses right now.

If you want someone to sit down with you, explain this in plain English, and give you a clear picture of where your business stands today, give us a call at (303) 664-1182. We will start with a conversation, not a sales pitch, and we will tell you exactly what we would do if it were our business.

That’s what People-First IT looks like.

Sources

1. Microsoft Entra Blog: "How to break the token theft cyber-attack chain" (147,000 token replay attacks detected, 111% YoY increase): https://techcommunity.microsoft.com/blog/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/4062700
2. Microsoft Digital Defense Report 2024 (146% rise in adversary-in-the-middle phishing attacks): https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2024
3. Obsidian Security 2025 SaaS Security Threat Report (MFA failed to prevent the attack in 84% of incidents investigated): https://www.obsidiansecurity.com/news/obsidian-security-launches-2025-saas-security-threat-report
4. Travelers v. ICS (cyber insurer sought to void policy after insured misrepresented MFA use): https://www.insurancejournal.com/news/national/2022/07/12/675516.htm
5. Coalition 2025 Cyber Claims Report (60% of claims from BEC and funds transfer fraud): https://www.coalitioninc.com/announcements/2025-cyber-claims-report
6. AT&T/Snowflake Breach (stolen credentials, 11 days undetected, 110 million customer records): https://krebsonsecurity.com/2024/07/hackers-steal-phone-sms-records-for-nearly-all-att-customers/
7. MGM Resorts Attack (Scattered Spider social-engineered help desk, ~$100M in damages): https://www.darkreading.com/endpoint-security/mgm-and-caesars-attacks-highlight-social-engineering-risks
8. Okta Support System Compromise (session tokens stolen, MFA bypassed for 1Password, Cloudflare): https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/
9. Verizon 2025 DBIR SMB Infographic (88% of SMB breaches involved ransomware, 33% involved stolen credentials): https://www.verizon.com/business/resources/infographics/2025-msi-smb-infographic.pdf
10. Mastercard 2025 Small Business Cybersecurity Survey (46% of SMBs attacked, nearly 1 in 5 went bankrupt or closed): https://www.mastercard.com/us/en/news-and-trends/stories/2025/small-business-cybersecurity-study.html
11. FBI IC3 Public Service Announcement (BEC losses totaling $55 billion, targeting small local businesses): https://www.ic3.gov/PSA/2024/PSA240911
12. Keeper Security Enterprise (cross-platform passkey management, zero-knowledge encryption, SOC 2/HIPAA/FedRAMP): https://www.keepersecurity.com/features/passkey-management/
13. Microsoft Authenticator Passkey Support (device-bound passkeys for Entra ID accounts): https://learn.microsoft.com/entra/identity/authentication/how-to-enable-authenticator-passkey
14. Windows Hello for Business Cloud Kerberos Trust (Microsoft’s recommended hybrid deployment model): https://learn.microsoft.com/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust

ViaTek | People-First IT | Lafayette, Colorado

(303) 664-1182 | viatek.net