Multi-Factor Authentication
Requiring two or more independent proofs of identity so that stealing any single credential is not enough to gain access.
Why One Factor Is Not Enough
A password alone is a single point of failure: it can be phished, guessed, reused, or leaked in a breach. Multi-factor authentication (MFA) requires proofs from two or more independent categories, so an attacker who obtains one still cannot get in. It is among the most effective single controls against account compromise, blocking the overwhelming majority of automated credential attacks.
The Factor Categories
- Something you know: password, PIN, passphrase
- Something you have: hardware token, phone, smart card
- Something you are: fingerprint, face, or other biometric
- (Sometimes) somewhere you are or something you do: location or behavior
True MFA combines different categories. Two passwords are not multi-factor; a password plus a hardware token is.
Not All Second Factors Are Equal
Second factors vary in strength. One-time codes sent by SMS are better than nothing but can be intercepted or phished. App-generated codes are stronger. Hardware security keys using public-key cryptography are the strongest common option because they are bound to the legitimate site and resist phishing entirely, the key will not authenticate to a lookalike domain.
Phishing-Resistant MFA
The move toward phishing-resistant factors, hardware keys and passkeys, addresses the fact that attackers now routinely relay one-time codes in real time. Binding the credential to the origin defeats that relay.
Fusion Context
Access to a fusion program's sensitive systems and any authorized remote access require multi-factor authentication, with phishing-resistant factors preferred for the highest-privilege roles. In the Hyperion breeder and burner designs, MFA is one layer of the access control that scopes command authority over safety-relevant systems, so that a single stolen credential cannot reach them.