How attackers get around two-factor authentication, and what stops them
Two-factor authentication is a big step up from a password alone, but attackers have adapted. The routes they use around it, the warning signs to watch for, and the factors that cannot be relayed.
Transcript
0:00Not the finish line
Two-factor authentication is a big step up from a password alone. But attackers have adapted, and knowing how is how you stop them.
0:09The password reset
Some services skip the second factor during a password reset. A reset email you did not ask for is a warning: change your email password first.
0:19Sign in with
Signing in with a Google or Microsoft account makes that account the key to everything behind it. Protect it with its own second factor.
0:29Attempt limits
A short code is only safe if the service limits the guesses. A warning about repeated failed sign-ins means change your password now.
0:38Backup codes
Backup codes are a sensible way back in, and a spare key for anyone who finds them. Keep them locked away.
0:47The person
The fastest-growing route is the person: a message asking you to read back a code, or a fake login page that collects it. No genuine service asks for your code.
0:59What stops it
Prefer an authenticator app to text codes. Where it matters, use a passkey or security key: they cannot be passed to a fake page.
1:09Book a Demo
Then train your people, and watch for the sign-in that succeeds from somewhere it should not. Book a demo.
Detection & Response
1:32
Detection & Response
Managed Microsoft Sentinel
How Wizard Cyber runs Microsoft Sentinel as a service inside your own tenant: AI agents investigate every alert to a verdict, and a senior analyst signs it off.
1:18
Detection & Response
Managed AI SOC
What Wizard Cyber’s Managed AI SOC gives you on every incident: a finished case from specialised AI agents on CYBERSHIELD AI, signed off by a senior analyst, in the Core, Complete or Command package.
1:34
Detection & Response
Microsoft XDR
Microsoft XDR explained: how Microsoft Defender and Microsoft Sentinel connect signals across identities, endpoints, email and cloud, group them into single incidents, and contain threats from one place.
Watch it run
on your own alert types.
An hour with a SOC analyst: a live investigation from signal to signed verdict, and the autonomy dial set where you would set it. Your scenarios, not a canned demo.