Which Identity Control Actually Stops Which Attack
MFA stops credential attacks at the login. SSO controls how often that login repeats. IAM controls whether the account should exist at all. Each one is useless against the attacks the other two are built for, and one common attack defeats all three. Knowing which is which is the entire buying decision.
Most comparisons of these three argue about definitions. That’s not useful when you’re holding quotes. What’s useful is knowing which control does the work in each scenario you’re actually worried about.
So let’s go attack by attack.
Password reused from a breached personal account
An employee used their work password on a retail site. That site got breached. The password is now in a credential dump.
MFA stops this cold. The password is valid, the second factor isn’t in the attacker’s hands, and the login fails.
SSO makes it worse. One password now unlocks more surface than it used to, so the value of that single credential goes up.
IAM limits the damage, because a well-governed account can only reach what the role needs.
Credential stuffing against your webmail
Automated login attempts, thousands of stolen username and password pairs, one target.
Only MFA matters here. SSO does nothing either way. IAM does nothing either way. This is the scenario every “just turn on MFA” recommendation was built for, and it’s the one where that advice is completely correct.
The evidence backs it. A peer-reviewed measurement study of Azure Active Directory accounts found MFA cut the risk of account compromise by 99.22%, and 98.56% even for accounts whose passwords had already leaked.
MFA fatigue, push approval spam at 3am
Attacker has the password. They trigger approval prompts repeatedly until a tired person taps yes.
This is where the form of MFA decides the outcome, not whether you have it. Push notifications and texted codes can be worn down or intercepted. CISA recognizes only two categories as genuinely phishing-resistant: FIDO/WebAuthn, which covers passkeys and hardware security keys, and certificate-based authentication.
Everything else beats a password alone and loses to those two. Worth knowing before you buy.
A former employee’s account is still active
Nobody disabled it. It still works.
MFA does nothing. It’s a real account with a real second factor. SSO does nothing, except broaden what that account reaches. Only governance closes this.
Get Consilien’s stories in your inbox
Join Medium for free to get updates from this writer.
This isn’t rare. That 2022 Beyond Identity survey of 1,121 workers and business leaders found 83% had kept using accounts from a previous employer after leaving.
An employee reaches data their role never needed
Someone in operations can open payroll. Not malice, usually. Just permissions that accumulated through a role change and never got removed.
MFA authenticates them correctly. SSO gets them there faster. Neither control has an opinion about whether they should be there, because that was never their job.
Governance again.
A stolen session token replayed after a real login
Now the hard one.
An adversary-in-the-middle attack puts a fake login page between your employee and the real one. They type the password. They approve the MFA prompt. Everything appears to work.
What the attacker steals isn’t the password. It’s the session token, the small file the identity provider hands the browser after a successful login to say this person is verified, stop asking. Steal that and you inherit the verified session outright. No password. No prompt, because as far as the system is concerned, the MFA already happened.
Then SSO does exactly what it was paid to do and carries that session into every connected application.
MFA is bypassed. SSO amplifies it. IAM limits how far it reaches, and that’s the only mitigation of the three.
What the pattern shows
Count them up. Two scenarios where MFA is the only control that matters. Two where only governance helps. One where the form of MFA decides everything. One where all three are on the back foot and containment is all you have.
No single layer covers the board. That’s not a sales argument, it’s just what the mapping shows.
The 2026 shift nobody priced in
The 2026 Verizon Data Breach Investigations Report found that vulnerability exploitation overtook stolen credentials as the top way into a breach, at 31%. First change at the top in 19 years.
Credentials didn’t become irrelevant. Credential abuse still appears in 39% of full breach chains. They moved position. Less about getting in, more about moving around once inside.
Which shifts the job of these three controls from perimeter to containment. Shorter token lifetimes. Re-authentication when a device or location changes. Sign-in policies that check device health before honoring a session at all.
One real example of blast radius
On October 30, 2025, an attacker got into a single employee’s PennKey single sign-on account at the University of Pennsylvania. From that one login they reached the VPN, Salesforce Marketing Cloud, Qlik, SAP business intelligence tools, SharePoint, and Box. Data on roughly 1.2 million people was gone inside about a day, and the attacker used the marketing platform to email around 700,000 recipients from legitimate Penn addresses.
One account. At an organization with a full security team.
That’s the tradeoff SSO makes, stated honestly. Convenience and blast radius are the same feature viewed from two directions. It’s still worth buying. It just can’t be the only thing you did.
Consilien helps companies with 20 to 500 users build identity controls that hold up across all six of these scenarios, not just the two everyone budgets for.
