4 MIN READ
Push notification MFA lost the room somewhere around 2023. The fatigue attacks, the help desk social engineering, the SIM swap, the proxy-in-the-middle kits that ship for 200 dollars a month, all of it landed on the same conclusion. The thing the user taps is no longer the thing that proves the user is who they say they are. The hardware token came back because the alternatives stopped working, not because the token is new.
The 2026 market tells the story. YubiKey 5, Google Titan, Feitian K9, all of them sitting at 25 to 50 dollars a token, with FIDO2 support now shipped by Apple, Google, and Microsoft on the same day. The typical enterprise rollout runs from 10,000 to 50,000 tokens, with the financial sector, the federal agencies, and the healthcare networks furthest along. The token works. The platforms support it. The deployment patterns are well understood. The only thing left to argue about is the timeline.
Why the push notification died
Three forces converged. The phishing kit evolved faster than the MFA did. Evilginx2 and its clones sit on commodity infrastructure and proxy the live session in real time, with the user watching the URL bar, with the user entering the code, with everything looking fine until the attacker walks away with the session cookie. The help desk social engineering wave hit at the same time. Scattered Spider got Okta, MGM, and a dozen casinos by calling the help desk, pretending to be a locked out employee, and walking through the MFA reset. The result was that the regulator, the customer, and the insurance carrier all started asking the same question. Where is the phishing resistant MFA, and where is the audit trail proving it works. CISA, NIST 800-63B, and the major enterprise customers all shifted the requirement up the stack.
Where the token fits
The privileged access path runs as the obvious starting point. Domain admin, root, production deploy keys, the accounts that produce the catastrophic breach. The high value application path runs as the next layer. Production databases, financial close systems, the customer data warehouse, anywhere the credential alone is enough to walk out with the company. The remote access path runs as the third. Contractors, partners, the developer on a personal laptop, all of them need to authenticate from a device the security org does not own. The token works in all three because the token does not depend on the device, the network, or the user being trained to spot a phishing site.
How to deploy at scale
Start with the privileged accounts. The cost is low (one token per admin plus a spare), the user base is small, and the risk reduction is large. If something goes wrong, the blast radius is contained to the group that already has the most monitoring.
Use a major brand. YubiKey, Titan, Feitian, all three have the supply chain audit, the firmware transparency, and the FIDO2 certification. Off brand tokens are cheaper. They also ship from factories that may not survive a customs inspection, and the security org will end up answering questions about provenance it does not want to answer.
Build the self service enrollment. 10,000 tokens cannot be hand delivered by the IT team. The shipping flow, the activation flow, the replacement flow for the token that got lost on a Tuesday, all of it has to be self serve, with the help desk handling the exceptions instead of the rule. The org that runs those three moves is the one that actually lands the hardware token at scale.
The bottom line
Start with the privileged accounts, buy the major brand, build the self service enrollment. The org that runs those three lands the hardware token at scale. The one that buys 200 tokens for the executive team and calls it a deployment does not.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
