Identity and Access Management: Why MFA Alone Isn’t Enough Anymore

MFA stops a stolen password from being enough on its own, but it does nothing about what a logged-in account can touch, or how fast a former employee’s access gets shut off.

Real identity and access management picks up right where MFA stops. It decides what an account can reach, for how long, and how quickly that access disappears the moment it should. VJNetworks has spent over 20 years building cybersecurity programs for small businesses across the Tri-State area, Rockland, Westchester, and Bergen, and the same pattern keeps showing up. A company rolls out MFA, checks the box, and assumes the identity problem is solved. It isn’t. Not even close.

What IAM Means, Once You Get Past the Acronym

Identity and access management, IAM for short, is the set of policies and tools that decide who gets into which systems, what they’re allowed to do once they’re in, and when that access ends. MFA covers exactly one piece of that. It verifies who’s logging in. Everything after the login screen is IAM’s job.

MFA became the default advice because it’s cheap, fast to roll out, and it genuinely stops a huge share of casual credential attacks. Fair enough. None of that is wrong. It’s just incomplete, and treating it as the finish line is where things go sideways. Wrong finish line, wrong game.

Why MFA Alone Keeps Failing, Even When It’s Turned On

CISA has a name for what happens when an attacker bombards a phone with MFA approval requests until the employee taps approve just to make the notifications stop. It’s called push bombing, or MFA fatigue, and CISA’s own fact sheet ranks it as a documented bypass technique, not a hypothetical one. Verizon’s 2025 Data Breach Investigations Report found prompt bombing showed up in 14% of social engineering incidents last year.

Adversary-in-the-middle phishing is worse, honestly. A fake login page sits between the employee and the real site, captures the session cookie the instant MFA succeeds, and the attacker walks in without ever touching the password again. Microsoft’s own security team was blunt about it. MFA is the reason attackers built AiTM session-theft kits in the first place. One campaign they tracked, tied to a group Microsoft calls Storm-1167, used a single stolen session to launch more than 16,000 follow-on phishing emails.

SIM swapping is the oldest trick on this list. Still works fine. The FBI’s Internet Crime Complaint Center logged 1,611 SIM swap complaints in 2021, more than $68 million in losses, just over five times the complaint volume of the three years before it combined. Text-message codes route straight to whatever SIM the attacker just ported the victim’s number onto. The phone never has to leave the attacker’s hand.

NIST agrees, for what it’s worth, and NIST doesn’t hand out restrictions lightly. The current NIST SP 800-63B-4 standard, finalized in 2025, formally restricts SMS and voice-based one-time codes as an authenticator category and requires phishing-resistant options, FIDO2 security keys and passkeys among them, at the higher assurance levels. That’s not a small technical footnote buried in an appendix. It’s the federal government saying, on the record, that the text-message code most small businesses still lean on is the weakest option on the shelf.

We’ve written before about how cyber insurers now draw a hard line between MFA that’s “enforced” and MFA that’s merely “available,” and push bombing is a big part of why underwriters started asking that question so specifically. This post isn’t about the insurance form. It’s about what protects you regardless of what any application happens to ask.

MFA Alone vs. What Full IAM Adds

Here’s the honest split, side by side. No spin.

The Building Blocks of Real IAM for a Company This Size

None of this requires an enterprise budget or a dedicated identity team. No new hardware, mostly. Just policy and configuration someone has to actually own. Taken together, these controls are what’s usually described as zero trust architecture, verifying every request instead of trusting anything by default just because it’s already inside the network.

• Least privilege access. A front-desk login has no business touching payroll records, and it shouldn’t be able to. This is the same principle NIST codifies as control AC-6 in its security and privacy control catalog, and it’s the single fastest fix most small businesses can make.
• Single sign-on. One login gets someone into the tools they’re cleared for, and when they leave, IT shuts off every connected app from one place instead of chasing logins across a dozen separate SaaS tools.
• Conditional access. This is the piece that catches a correct password and a correct MFA code arriving from a country the business has never operated in, and either blocks it or challenges it before it goes any further.
• Privileged access management. The login someone uses to check email in the morning should never be the same login that manages the domain controller in the afternoon.
• Access recertification. Somebody sits down, on a set schedule, and looks at who still has access to what, then asks whether that access still makes sense. Not once. On a schedule.
• Prompt deprovisioning. The day someone leaves, whether that’s their decision or the company’s, every login gets cut. Same day. Not whenever IT gets around to it.
• Phishing-resistant MFA where it counts most. Admin accounts and remote access first, using a physical FIDO2 security key or a device passkey instead of a text-message code.

What Gets Missed Costs More Than People Expect

Stolen credentials, not malware, not some novel zero-day, are still the single most common way into a business’s systems. Not close, either. Verizon’s 2025 DBIR found credential abuse was the leading initial access vector for the second year running, showing up in 22% of breaches report-wide, and 88% of Basic Web Application attacks, one of the patterns that hits smaller companies hardest, ran on stolen logins alone.

Then there’s the part almost nobody budgets for. Someone stops working there, and their access doesn’t always stop with them. A February 2022 survey of more than 1,100 employees and business leaders, reported independently by Digital Journal, found that 83% of former employees said they kept accessing a past employer’s accounts after they left. More than half admitted using that access to cause harm. Only half of the employers in that same survey said they even changed passwords during offboarding.

Read that again. Half.

What This Looks Like Day to Day for a 5 to 60 Person Company

None of this has to look like an enterprise identity project with a six-month rollout plan and a steering committee. For a landscaping company in Bergen, NJ, a medical device distributor in Westchester, or a logistics outfit in Rockland, the version that actually works starts small. Figure out who has admin rights and why. Shut off the accounts nobody remembers creating. Put one login policy in writing that everyone follows, including the owner.

A password manager helps here too, even though it’s a different tool than IAM strictly speaking. We recommend BitWarden. Simple reason. One place to generate and store strong, unique logins instead of the same reused password sitting in six different systems.

Over 20 years across the Tri-State area, one pattern holds steady. 97% client retention. Access control that actually gets maintained, not just set up once and forgotten, is a large part of why that number holds.

This is usually where ongoing managed IT support earns its keep. Not the initial setup. The maintenance nobody has time for six months later. Access reviews don’t run themselves.

Before You Assume MFA Has You Covered