Multi-factor authentication (MFA) software secures users’ accounts by requiring them to prove their identity in two or more ways before granting access to accounts, sensitive information, systems, or applications. In addition to a single authentication factor, such as inputting a username and password, users are prompted to provide a second authentication factor to validate who the user says they are. Examples of authentication factors include one-time passcodes (OTPs) for SMS, email, or phone call, software tokens, hardware tokens, which are commonly small thumb drives or keycards, mobile-push on a software application to a mobile device, biometric factors, and contextual or risk-based authentication.
Businesses use MFA tools for security purposes to confirm a user is who they say they are prior to accessing privileged information or applications. This software can help companies prevent internal theft or data loss, as well as external access from unapproved parties. MFA tools are traditionally used by businesses, but they can also be used by individuals hoping to improve security on their personal devices or online accounts.
Risk-based authentication software is a form of MFA, but achieves authentication through different means by taking into account factors such as the user’s geolocation, IP address, IP address reputation, time since last authentication, device posture, device management, and other factors to determine the user’s authentication and risk. Passwordless authentication software is a form of MFA as well, which eliminates passwords as an authentication factor, instead relying on additional factors to authenticate a user.
MFA software can be sold as a point solution, where it can be integrated with a business’ user accounts, or it can be sold as part of a compound solution, typically in identity products, such as workforce-based identity and access management (IAM) software or customer-based customer identity and access management (CIAM) solutions.
To qualify for inclusion in the Multi-Factor Authentication (MFA) category, a product must:
Utilize a secondary authentication method such as OTPs, mobile push, software token, hardware token, biometric factors, or more
Prompt authentication from a user
Allow for triggered MFA for new users and devices
