Scorecard 01 · 10 questions · 2 minutes · instant result
Is your MFA phishing-resistant?
Ten questions on methods, coverage, recovery and the help desk. An instant score and your top gaps, mapped to what to fix first.
CISA names FIDO/WebAuthn and PKI-based authentication as the phishing-resistant forms of MFA. Push without number matching, one-time codes and SMS each have documented failure modes.
Source: CISA, Implementing Phishing-Resistant MFA
Source: CISA, Implementing Phishing-Resistant MFA
Your answers stay in this browser. We count completions anonymously, and nothing you select is sent unless you choose to email it to us.
More scorecards
01 / 10 questions / 2 minutes
Is your MFA phishing-resistant?
Methods, coverage, recovery and the help desk reset path.
Take the scorecard →02 / 10 questions / 2 minutesIs your team ready for an identity attack?
Detection, response ownership, session revocation and practice.
Take the scorecard →03 / 10 questions / 2 minutesAre your AI agents governed?
Inventory, ownership, credentials, lifecycle and review.
Take the scorecard →