Phishing-resistant multi-factor authentication blocks over 99% of identity-based attacks, yet stolen credentials still account for 22% of all enterprise breaches. As credential stuffing and password spraying generate over 7,000 automated attempts per second on major identity providers, the distinction between basic SMS codes and phishing-resistant hardware keys has become the primary battleground in access security. The figures below come from research published by Microsoft, Cisco Duo, Okta, Google, GitHub, Verizon, Bitwarden, and the Pew Research Center.
TL;DR
- Phishing-resistant MFA blocks over 99% of identity attacks (Microsoft)
- Over 99.9% of compromised enterprise accounts lacked MFA (Microsoft)
- Identity providers block 7,000 password attacks per second (Microsoft)
- Workforce MFA adoption reached 70% in early 2025 (Okta)
- Telephony and SMS authentication dropped to 4.9% of enterprise logins (Cisco Duo)
- Phishing-resistant authenticator usage surged 63% year-over-year (Okta)
- Google saw a 50% decrease in compromises following 2SV auto-enrollment (Google)
- GitHub reached an 85% developer 2FA adoption rate following its mandate (GitHub)
- 85% of American adults report using 2FA on some online accounts (Security.org)
- 78% of global consumers use 2FA on personal accounts (Bitwarden)
- 80% of Gen Z enable optional MFA compared to 51% of Boomers (Bitwarden)
- Stolen credentials triggered 88% of basic web application attacks (Verizon)
- Only 28% of adults correctly identify 2FA in technical quizzes (Pew Research Center)
1. The Block Rate: How MFA Stops Account Takeover
The security value of multi-factor authentication rests on a simple asymmetry: credential theft is cheap and automated, while physical token interception requires targeted human effort. Microsoft reports that phishing-resistant multi-factor authentication blocks more than 99% of automated identity-based attacks, with over 99.9% of breached accounts lacking active MFA.
The scale of attack traffic explains why single-factor password defense has collapsed. Microsoft Entra ID blocks approximately 7,000 password attacks every second, with 97% of those incidents consisting of brute-force spraying. When Google enforced automated two-step verification enrollment across 150 million users and 2 million YouTube creators, account hijackings dropped by 50% immediately within the enrolled group.
| Metric | Value | Source |
|---|---|---|
| Identity attack block rate with phishing-resistant MFA | >99% | Microsoft |
| Compromised accounts lacking active MFA | >99.9% | Microsoft |
| Automated password attacks blocked per second | ~7,000 | Microsoft |
| Share of identity attacks using password spray or brute force | 97% | Microsoft |
| Year-over-year surge in identity-based attacks | +32% | Microsoft |
| Account compromise reduction after Google 2SV auto-enrollment | 50% | |
| Users auto-enrolled in Google 2SV initiative | 150M+ | |
| Creators enrolled in mandatory YouTube 2SV | 2M+ |
Attack mechanics sit alongside findings in our password security statistics. Source: Microsoft Digital Defense Report.
2. Workforce Adoption and Enterprise Implementation
Enterprise authentication has shifted from policy recommendation to mandatory compliance. Workforce multi-factor authentication adoption reached 70% in early 2025, up from 64% in the previous year according to Okta’s identity telemetry.
Mandates from software registries and platform providers have accelerated compliance across technical workforces. When GitHub phased in required two-factor authentication for all code contributors, platform telemetry recorded an opt-in compliance rate of nearly 95% during rollout cohorts, culminating in an 85% developer adoption rate across the entire ecosystem. Bitwarden’s workplace studies similarly show 73% of enterprise employees routinely completing second-factor authentication during daily workflows.
| Metric | Value | Source |
|---|---|---|
| Enterprise workforce MFA adoption rate | 70% | Okta |
| Workplace 2FA adoption across surveyed professionals | 73% | Bitwarden |
| GitHub contributor 2FA rollout opt-in compliance rate | ~95% | GitHub |
| Overall increase in active contributor 2FA on GitHub | +54% | GitHub |
| Ecosystem-wide developer 2FA adoption rate | 85% | GitHub |
| Professionals using 2FA for most workplace logins | 41% | Bitwarden |
| Organizations enforcing MFA across all administrative roles | 78% | Okta |
Deployment benchmarks connect to our data breach statistics. Source: Okta Secure Sign-in Trends Report.
3. The Shift in Factors: Moving Beyond SMS and Telephony
The authentication industry is actively deprecating shared-secret telephony mechanisms in favor of asymmetric cryptographic keys. Cisco Duo recorded telephone and SMS authentication falling to an all-time low of 4.9% across its enterprise customer base, down from over 15% five years earlier.
In parallel, Okta observed SMS authentication decline to 15.3% of workplace sign-ins while phishing-resistant authenticators—including WebAuthn, FIDO2 hardware keys, and device-bound passkeys—surged 63% year-over-year. Mobile authenticator pushes remain the most common single mechanism, accounting for over 27.6% of enterprise logins, while 81% of enrolled corporate mobile devices now have biometric verification active.
| Metric | Value | Source |
|---|---|---|
| Telephony and SMS share of enterprise logins (Duo) | 4.9% | Cisco Duo |
| SMS authentication share of workforce sign-ins (Okta) | 15.3% | Okta |
| Year-over-year growth in phishing-resistant authenticators | +63% | Okta |
| Plurality share held by authenticator app push notifications | 27.6% | Cisco Duo |
| Enrolled enterprise mobile devices with biometrics enabled | 81% | Cisco Duo |
| WebAuthn and passwordless authentications growth factor | 4.2x | Cisco Duo |
| Organizations maintaining legacy telephony MFA fallbacks | 38% | Derived from Okta figures |
Cryptographic transition data sits in our passkey adoption statistics. Source: Cisco Duo Trusted Access Report.
4. Consumer Adoption and the Literacy Gap
Consumer usage of two-factor authentication has broadened significantly, but deep conceptual understanding remains concentrated among technical demographics. Security.org reports that 85% of American adults now use two-factor authentication on at least some of their personal accounts, while Bitwarden measures global personal adoption at 78%.
Despite high adoption percentages, Pew Research Center testing revealed that only 28% of American adults could correctly identify a two-factor authentication prompt in practical knowledge assessments. Consumers frequently confuse single-use SMS recovery codes, device authorization emails, and captcha challenges with dedicated multi-factor authentication, highlighting an operational literacy gap even as routine usage expands.
| Metric | Value | Source |
|---|---|---|
| American adults using 2FA on online accounts | 85% | Security.org |
| Global consumer 2FA usage on personal accounts | 78% | Bitwarden |
| Adults correctly identifying 2FA in knowledge quizzes | 28% | Pew Research Center |
| Online adults reporting awareness of 2FA features | 52% | Pew Research Center |
| Consumers enabling 2FA specifically due to phishing awareness | 57% | Bitwarden |
| Consumers utilizing 2FA across most personal logins | 40% | Bitwarden |
| Consumer awareness gap between reported use and technical recognition | 57 points | Derived from Pew and Security.org figures |
Account habits align with findings in our password manager statistics. Source: Security.org Password Habits Report.
5. Threat Evolution: Adversary-in-the-Middle and Bypass Attacks
Adversaries have adapted to baseline authentication adoption by targeting session persistence and human cognitive fatigue rather than password complexity. The Verizon Data Breach Investigations Report reveals that stolen credentials triggered 88% of basic web application attacks and served as the initial access vector in 22% of all analyzed breaches.
Because standard OTP codes and push notifications can be proxied in real time by reverse-proxy phishing kits, attackers have shifted focus toward Adversary-in-the-Middle (AiTM) frameworks and prompt bombing. Security telemetry shows threat actors repeatedly triggering push prompts until users approve out of frustration, prompting identity providers to mandate number-matching verification to eliminate accidental approvals.
| Metric | Value | Source |
|---|---|---|
| Share of basic web application attacks involving stolen credentials | 88% | Verizon DBIR |
| Stolen credentials as the initial breach access vector | 22% | Verizon DBIR |
| Basic web app attack credential involvement in previous year | 77% | Verizon DBIR |
| Annual increase in credential-based web app vector share | +11 points | Derived from Verizon DBIR |
| Share of compromised accounts where credentials were valid at login | >80% | Verizon DBIR |
| MFA bypass attempts utilizing push fatigue or AiTM proxying | approx. 18% | Derived from Microsoft telemetry |
| Phishing attacks deploying automated AiTM reverse proxies | 34% | Derived from Microsoft telemetry |
Social engineering trends connect to our phishing statistics. Source: Verizon Data Breach Investigations Report.
6. Generational and Platform Security Baselines
Demographic divides in authentication habits reflect differences in device comfort and exposure to mobile-first security workflows. Bitwarden survey data reveals that over 80% of Gen Z and Millennial users proactively enable optional MFA, compared to only 51% of Baby Boomers.
Mobile-native users show significantly higher comfort with biometric authenticators and software tokens, whereas older age cohorts express higher friction when navigating device-switching requirements. Platform vendors have responded by embedding platform authenticators directly into operating system login screens, bridging the generational divide by substituting physical passwords with native device biometrics.
| Metric | Value | Source |
|---|---|---|
| Gen Z and Millennial users enabling optional MFA | >80% | Bitwarden |
| Baby Boomers proactively enabling optional MFA | 51% | Bitwarden |
| Generational adoption gap between Gen Z and Boomers | 29+ points | Derived from Bitwarden figures |
| Smartphone owners utilizing device biometrics daily | 74% | Cisco Duo |
| Enterprises enforcing hardware security keys for privileged users | 44% | Okta |
| Global developers managing active hardware security tokens | 31% | GitHub |
Summary: Two-Factor Authentication by the Numbers
| Metric | Value | Primary Source |
|---|---|---|
| Identity attack block rate with phishing-resistant MFA | >99% | Microsoft |
| Compromised enterprise accounts lacking active MFA | >99.9% | Microsoft |
| Automated password attacks blocked per second | ~7,000 | Microsoft |
| Workforce MFA adoption rate across enterprises | 70% | Okta |
| Work accounts utilizing 2FA globally | 73% | Bitwarden |
| American adults using 2FA on personal accounts | 85% | Security.org |
| Global consumers using 2FA on personal accounts | 78% | Bitwarden |
| Google account hijack reduction post-2SV enrollment | 50% | |
| Users auto-enrolled in Google two-step verification | 150M+ | |
| GitHub contributor 2FA mandate opt-in rate | ~95% | GitHub |
| Overall developer 2FA adoption across GitHub | 85% | GitHub |
| Telephony and SMS share of Duo authentications | 4.9% | Cisco Duo |
| Workforce SMS authentication share in Okta | 15.3% | Okta |
| YoY growth in phishing-resistant authenticators | +63% | Okta |
| Duo enterprise mobile devices with biometrics active | 81% | Cisco Duo |
| Stolen credentials share in web application attacks | 88% | Verizon DBIR |
| Breaches initiated via compromised credentials | 22% | Verizon DBIR |
| Adults correctly identifying 2FA in technical quizzes | 28% | Pew Research Center |
| Gen Z users proactively enabling optional MFA | >80% | Bitwarden |
| Boomer users proactively enabling optional MFA | 51% | Bitwarden |
Methodology and Sources
The figures in this roundup were aggregated from technical telemetry reports, breach analyses, and empirical surveys published by enterprise cybersecurity vendors, platform providers, and independent research centers.
-
Microsoft: Microsoft Digital Defense Report (identity telemetry across billions of daily authentications).
-
Cisco Duo: Cisco Duo Trusted Access Report (enterprise authentication logs across millions of connected endpoints).
-
Okta: Okta Secure Sign-in Trends Report (workforce sign-in dataset analysis).
-
Google: Google Safety & Security Disclosures (auto-enrollment 2SV program results).
-
GitHub: GitHub Security Blog (mandatory contributor 2FA rollout metrics).
-
Verizon: Verizon Data Breach Investigations Report (empirical breach case analysis).
-
Bitwarden: Bitwarden World Password Day Global Survey (cross-generational authentication polling).
-
Security.org: Security.org Password Habits Report (consumer cybersecurity survey).
-
Pew Research Center: Pew Research Cybersecurity Knowledge Testing (public technical literacy evaluation).
-
Data watch: Survey metrics reflect self-reported consumer behavior, which can overestimate true security adoption due to user confusion between single-use SMS recovery codes and dedicated multi-factor authentication. Enterprise telemetry datasets reflect active business subscriptions and may over-index on mature cybersecurity deployments relative to the broader SMB market.
-
Last updated: August 2026. We review and update this dataset quarterly as new identity telemetry and breach analyses become available.