What Is MFA (Multi-Factor Authentication)?
Multi-Factor Authentication (MFA) is an authentication method that requires a user to present two or more independent forms of verification—typically something they know (a password), something they have (a hardware token or authenticator app), or something they are (biometrics)—before being granted access to a system. MFA significantly reduces the risk of account compromise from stolen or guessed passwords alone, since an attacker would also need to bypass the second factor. It is widely mandated by security frameworks and regulations as a baseline control for human user accounts, particularly for privileged or remote access, and is commonly delivered through push notifications, one-time codes, or physical security keys.
Why It Matters
MFA is one of the most effective controls available for human accounts, but it has a structural blind spot: non-human identities—service accounts, API keys, and OAuth tokens—generally cannot use it. Machines cannot respond to a push notification or type a one-time code, so most automated systems authenticate with a single factor: a static secret. That secret becomes the sole barrier between an attacker and the system, and because it doesn't rotate or expire the way an MFA-protected human login is protected, a leaked API key or service account credential often grants immediate, unchallenged access. France's NIS2 transposition (the Resilience bill) is still before Parliament; ANSSI has already published the ReCyF framework so entities can prepare. As organizations lock down human logins with MFA, non-human identities increasingly become the easier path in, since they were never designed to require a second factor at all.
How Cydenti Helps
Since non-human identities can't complete an MFA challenge, Cydenti compensates with continuous behavioral verification instead—monitoring how each service account, API key, and machine credential is actually used, and flagging deviations, excessive privilege, or anomalous access patterns that would be caught by a second factor if one existed. This gives security teams an MFA-equivalent layer of assurance for the identity population that authentication frameworks were never built to protect, closing a gap that NIS2 and ReCyF Objective 10 increasingly require organizations to address.
Explore →Frequently Asked Questions
Why can't service accounts use MFA?
MFA requires a human to respond to a prompt, code, or biometric check, which automated systems can't do without breaking the automation. Service accounts, API keys, and bots therefore typically rely on a single static secret for authentication, making that secret's protection and rotation far more critical than for human accounts.
Is MFA required for machine identities under NIS2?
NIS2 and ANSSI's ReCyF Objective 10 require strong access controls for service accounts and machine credentials, but since traditional MFA doesn't apply, compliance typically relies on alternative controls: strict credential rotation, least-privilege scoping, and continuous monitoring of non-human identity behavior.
Discover the machine identities you didn't know you had
— the first inventory usually lands within a week.
The Audit Flash connects up to three SaaS apps through a read-only API and lists the service accounts, orphaned credentials, OAuth grants, and AI agents it can see. The first identity inventory usually lands within a week. A full sharing scan on a large tenant can take longer. No commitment.
No commitment • No credit card • Data hosted in Europe • Response within 24h