First, What Is MFA Bombing?
MFA bombing, also called MFA fatigue, is a brutally simple and effective attack. An attacker first gets a user's password, often from a previous data breach. Then, they use it to try to log in, which triggers a push notification to the user's phone asking
them to approve the sign-in. The attacker just keeps hitting "log in" over and over, spamming the user with dozens or hundreds of prompts. The goal is to exploit human psychology. Out of sheer annoyance, confusion, or the mistaken belief that it's a system glitch, the user eventually taps "Approve" just to make the notifications stop. High-profile breaches at companies like Uber and Microsoft have been traced back to this exact technique, proving that it can defeat even well-funded security programs. The attack doesn't break the technology; it breaks the person.
The Fortress Approach: Block and Lock
The first school of thought is rooted in a security-first, zero-tolerance mindset. Proponents of this approach argue that the moment a potential MFA bombing attack is detected—say, after three to five failed or ignored prompts in a short window—the system should act decisively. This means immediately rate-limiting the requests, escalating the alert, or even locking the user's account entirely to stop the attack cold. The logic is clear: prevent the breach at all costs. The upside is that this method effectively halts an in-progress attack before a fatigued user can make a mistake. The downside, however, is significant disruption. Legitimate users can easily get locked out by system glitches or their own simple mistakes, leading to a flood of help-desk tickets and immense employee frustration, ultimately hurting productivity.
The Analyst's Approach: Detect and Adapt
The opposing viewpoint argues for a more nuanced, intelligence-led response. Instead of a hard-and-fast rule, this philosophy relies on adaptive authentication. An advanced system analyzes a flurry of MFA prompts in context, correlating it with other risk signals: Is the login attempt coming from an unusual location or a new device? Is it happening outside of the user's normal work hours? If the risk score is high, the system can "step-up" the authentication, perhaps requiring a number-matching challenge or a biometric scan instead of a simple push approval. This method is far less disruptive for users and generates fewer false positives. But it has its own major weaknesses. It is slower to respond and requires a mature, well-staffed Security Operations Center (SOC) with skilled analysts to investigate the alerts. For many companies, the expensive tooling and specialized talent required for this approach are simply out of reach.
The Real Disagreement: Friction vs. Risk
The debate isn't really about which tool is better. The real reason for the disagreement is a fundamental philosophical divide over the balance between user experience and security. The "Fortress" camp prioritizes eliminating risk, accepting high user friction as a necessary cost of doing business securely. They believe a locked-out user is better than a breached network. The "Analyst" camp prioritizes a seamless user experience to maintain productivity, accepting a degree of managed risk. They argue that overly restrictive security just encourages users to find unsafe workarounds—a phenomenon known as "shadow IT." This conflict forces every organization to ask itself a difficult question: How much pain are we willing to inflict on our users in the name of security? The answer depends entirely on a company's resources, risk appetite, and culture.
