Authentication Survivability Matters More Than MFA
Multi-factor authentication tells you how hard it is to compromise an identity. Survivability tells you what happens to the organisation when the identity provider itself goes down.
Key Takeaways
- MFA reduces the probability of compromise; survivability determines the consequence of an outage.
- Most organisations have never tested what happens when the primary identity provider is unavailable.
- Survivability requires independent secondary paths, not a single provider with more factors bolted on.
Two different problems, often treated as one
Most identity investment over the past five years has gone into multi-factor authentication, and for good reason — it materially reduces the likelihood that a stolen credential becomes a successful compromise. But MFA answers a narrower question than most organisations assume. It tells you how hard it is for an attacker to get in. It says nothing about what happens to the business when the identity provider itself is unavailable, whether through outage, misconfiguration or targeted attack.
Survivability is a different discipline: designing identity architecture so that a single point of failure in the identity provider does not become a single point of failure for the organisation. Very few organisations have genuinely tested this. Fewer still have a governed, time-boxed emergency access process rather than an informal one that lives in a runbook nobody has opened in two years.
What a survivable identity architecture looks like
A survivable architecture separates authentication into layers: a primary identity provider for day-to-day access, independent secondary controls for critical systems that do not share a common failure mode with the primary, clearly defined offline access patterns, and a governed emergency access process with strict time-boxing and audit. None of this replaces MFA — it sits alongside it, answering a question MFA was never designed to answer.
The governance layer matters as much as the technical design. Emergency access credentials that are never rotated, never tested and known to too many people are not a resilience control — they are a second, ungoverned identity provider hiding inside the first one.
The board-level question
If your identity provider became unavailable for four hours during a business-critical period, what would happen? Most executive teams have not had a satisfactory answer to this question tested in the last year. That is the gap survivability architecture exists to close.
Facing this challenge inside your own organisation? Schedule a strategic architecture review to talk it through.