How Hackers Bypass MFA: 4 Ways Attackers Hack 2FA

How hackers bypass MFA: four methods attackers use to get around two-factor (2FA) and multi-factor authentication, and the defenses for each.Multi-factor authentication, done right, is a powerful and low-cost way to protect against the weakest link in cybersecurity defense: the user's password. But attacks on MFA were once considered a proof of concept, and they have since proven both successful and common in the real world. This episode reviews four common techniques and how to mitigate them.Key takeaways:• Evilginx2: a phishing framework that acts as a proxy between the user and the real site, capturing authentication cookies• Pass the cookie: stealing a session cookie from a compromised browser and replaying it elsewhere to skip the login and the second factor• SMS man-in-the-middle and SIM swap: why SMS codes are a weak second factor• Attacks on soft and hard tokens, including a researcher who spotted an employee's RSA key fob through an open webcam• Defenses covered: check the domain you're visiting and use a physical hardware key (U2F) against Evilginx2; allow only authorized IPs or certificate-holding devices, and re-authenticate on new browsers, against pass the cookie; and never use SMS or email for one-time codes, preferring hard or soft tokensChapters:0:00 Welcome0:27 Why attackers target MFA1:22 Evilginx2 framework3:07 Evilginx2 defense and protection4:01 Pass the cookie5:26 Pass the cookie defense and protection6:12 SMS man-in-the-middle6:50 SIM swap8:29 Attack on soft and hard tokens9:38 Hard token example10:03 Takeaway and wrap-upWatch the full video: https://www.youtube.com/watch?v=GexQHFt9fTEArticles and more resources: https://cisoperspective.comBlog post: https://cisoperspective.com/2025/04/13/hacking-two-factor-authentication-four-methods-for-bypassing-2fa-and-mfa/X: https://x.com/CISOPerspectiveResources mentioned in the video:• Evilginx2 on GitHub: https://github.com/kgretzky/evilginx2• Pass the cookie example: https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/Keywords: MFA bypass, 2FA bypass, how hackers bypass MFA, multi-factor authentication, two-factor authentication, pass the cookie, SIM swap, Evilginx2, cybersecurity podcast

SASE deployment models explained: Cloud SASE vs. Sovereign SASE, and how to place your requirements from Level 1 to Level 5 on the SASE Sovereignty Scale.SASE started as a cloud-delivered security model. Today it comes in deployment models that range from fully cloud to fully on-prem, driven by organizations and governments that need more control over where their data is stored, where security inspection happens, and who operates the infrastructure. This episode compares six SASE deployment models by where the three core components live and who runs them.Key takeaways:• The three core SASE components: the control plane, the data plane, and user data and logs• Level 1, Cloud SASE: the provider runs everything, and remote access from another country can itself count as an international data transfer• Level 2, data residency: logs, telemetry and customer data stay in a region, but data residency is not the same as log residency• Level 3, in-country processing: inspection and data stay in-country, but a third party subject to its home jurisdiction still operates the service• Customer-hosted PoP: local inspection and better performance for large sites, but not a sovereignty control on its own (Level 1 by default)• Level 4, Sovereign SASE with a cloud-managed control plane: inspection and customer data stay on-premises• Level 5, fully self-hosted Sovereign SASE: the control plane moves on-premises too, up to air-gapped deployments• The levels are requirements, not a ranking. Pick a "sovereign enough" model, not automatically Level 5, and weigh who operates it and where it's managed from as heavily as where your data livesChapters:0:00 Intro0:27 Why SASE deployment models evolved1:16 The three core SASE components2:49 Cloud SASE and the SASE Sovereignty Scale3:56 Level 1: Cloud SASE4:54 Level 2: Data residency6:23 Level 3: In-country processing7:48 The customer-hosted PoP9:07 Levels 4 and 5: Sovereign SASE11:03 The full scale: choosing "sovereign enough"12:16 Closing takeawaySources:• Gartner, "How to Choose a Sovereign SASE Deployment Model" (Sep 2026): https://www.gartner.com/en/documents/8395381• DORA, Regulation (EU) 2022/2554, Art. 30: https://eur-lex.europa.eu/eli/reg/2022/2554/ojMore from The CISO Perspective: https://cisoperspective.comWatch the full video: https://www.youtube.com/watch?v=71zTuHOxZuoFollow on X: @CISOPerspectiveKeywords: SASE, SASE deployment models, sovereign SASE, cloud SASE vs sovereign SASE, what is SASE, secure access service edge, data sovereignty, digital sovereignty, data residency, in-country processing, SASE architecture, cybersecurity podcast

Q-Day is the point when quantum computers become powerful enough to break today's encryption. This episode explains how quantum computing threatens RSA-2048 and ECC, how close the timeline really is, and what post-quantum cryptography and NIST's migration guidance mean for security teams.Key takeaways:• Bits vs qubits and why quantum breaks RSA and ECC• The quantum timeline, from the NISQ era and Google's Willow to full-scale quantum• What post-quantum cryptography (PQC) is and NIST's migration recommendations• Preparing for Q-Day by classifying your data nowChapters:0:00 Intro0:11 Modern Bits vs Qubits1:11 Quantum Computing Basics (Qubit)2:14 Quantum's Risk on Cryptography3:02 Quantum Computing Timeline3:11 The NISQ Era and Google's Willow4:03 The Next Era of Quantum Computing4:27 The Era of Cryptographic Relevant Zone4:38 Google Prediction for Cracking RSA 20485:23 Full Scale Quantum Computing5:57 Post Quantum Preparation6:25 Post Quantum Cryptography (PQC)7:04 NIST Recommendations for Migration to PQC7:38 Preparing for Q-Day by Classifying DataWatch the full video: https://youtu.be/8usat6J3ZfcMore from The CISO Perspective: https://cisoperspective.com

AI agents now reach your email, files and business apps through the Model Context Protocol (MCP), and Backslash Security found that nearly a third of the most popular MCP servers carried at least one security risk finding. This episode explains how MCP works and walks through the 34 threats the Coalition for Secure AI (CoSAI) lists in its MCP security framework.Key takeaways:• What MCP is: a standard way for AI agents to discover and use tools, either natively or through a separate MCP server• Why connecting an agent to untrusted content opens a new pathway into the corporate environment• Conventional threats (19): weak authentication, excessive privileges, insecure network configuration, poor credential management• MCP-contextualized threats (8): prompt injection, confused deputy, denial of wallet, man-in-the-middle, consent fatigue• MCP-specific threats (7): identity spoofing, tool poisoning, full schema poisoning, resource content poisoning, typosquatting, shadow MCP servers, over-reliance on the LLM• You don't need to reinvent security for AI agents; extend least privilege, strong authentication, segmentation and vulnerability management, and avoid "slop security"Chapters:0:00 Intro: why MCP security matters1:04 What is MCP?2:17 The CoSAI framework3:46 Conventional threats5:34 MCP-contextualized threats7:06 MCP-specific threats8:51 Wrapping up: trust and "slop security"9:17 ClosingSources:• Backslash Security, MCP server security research (Sep 2026): https://www.backslash.security/blog/mcp-server-security-risks-research• CoSAI, Model Context Protocol Security v2.0 (Sep 2026): https://www.coalitionforsecureai.org/wp-content/uploads/2026/09/model-context-protocol-security-v2.0.pdf• Snyk, malicious "postmark-mcp" npm package (Sep 2025): https://snyk.io/blog/malicious-mcp-server-on-npm-postmark-mcp-harvests-emails/Watch the full video: https://youtu.be/iD6oqZV8AlEMore from The CISO Perspective: https://cisoperspective.com

Verizon's 2026 DBIR found the human element in 62% of breaches, and increasingly the browser is where users get tricked into running the attack themselves. This episode compares remote browser isolation (RBI) and the secure enterprise browser: how each works, what problem each solves, and where they fit in SASE.Key takeaways:• How RBI runs risky pages in a disposable cloud browser (pixel streaming vs DOM reconstruction)• Why RBI is applied selectively through a secure web gateway or SASE platform• How a secure enterprise browser puts policy inside the session: copy/paste, uploads, downloads, credentials• Rule of thumb: isolate when the page is the threat; secure the browser when the work is trusted but the user, device or data needs controlChapters:0:00 Intro: the human element and the browser1:07 The two options: RBI vs secure enterprise browsing1:54 How remote browser isolation (RBI) works2:33 Pixel streaming vs DOM reconstruction3:10 Why RBI is applied selectively4:11 How secure enterprise browsing works5:03 Policy controls inside the browser session5:52 So which one do you need?6:25 Where they fit: SASE and Gartner's outlook6:52 The rule of thumbWatch the full video: https://youtu.be/ttmgM_AbkgUMore from The CISO Perspective: https://cisoperspective.com

Security teams can find vulnerabilities faster than ever. The hard part is deciding which exposures actually matter. This episode breaks down Continuous Threat Exposure Management (CTEM), Gartner's five-stage program for focusing on the exposures that create real business risk.Key takeaways:• CTEM is a program, not a product you buy• The five stages: scoping, discovery, prioritization, validation and mobilization• Prioritizing with KEV and EPSS instead of trying to fix everything• Why the cycle has to stay continuousChapters:0:00 The vulnerability volume problem0:25 What is CTEM?1:54 The five stages at a glance2:10 Stage 1 - Scoping2:57 Stage 2 - Discovery3:54 Stage 3 - Prioritization5:00 Stage 4 - Validation6:01 Stage 5 - Mobilization6:32 The goal of CTEM7:08 Why the cycle stays continuousWatch the full video: https://youtu.be/Mu0PcfaHLEoMore from The CISO Perspective: https://cisoperspective.com

Extended Detection and Response (XDR) is a cybersecurity tool that integrates with multiple products to detect and respond to threats. While EDR (Endpoint Detection and Response) focuses on the endpoint, XDR uses A.I. to ingests information from multiple sources and detect patterns across different device types. You’ll learn:What EDR does: how it monitors endpoint activity and helps isolate threats in real time  How MDR elevates EDR by providing 24/7 managed monitoring, threat hunting, and guided response from security experts  How XDR takes it further—correlating data across endpoints, network, cloud, identities, and more to give a unified view and faster response   A clear breakdown of each detection layerA comparison of when to use which solution (or combination)Practical tips for choosing based on your organization’s expertise and infrastructureWhether you’re defining your security strategy or just curious about detection platforms, this episode gives you:Topics covered: EDR functionality, MDR benefits, XDR scope, vendor considerations, and strategic fit for CISOs and security practitioners. Tune in to sharpen your detection stack—without the jargon.

How do you turn Zero Trust theory into real-world implementation?In this episode of The CISO Perspective, we break down the actual technologies and solutions that power modern Zero Trust Architecture (ZTA). You’ll hear how tools like identity providers, next-gen firewalls, endpoint protection, and segmentation gateways all work together to meet the core principles of NIST SP 800-207.We’ll explore how each technology brings unique strengths to the framework — and more importantly, how they integrate to build a practical, enforceable Zero Trust environment.👉 This is Part 2 of our Zero Trust series. If you missed Part 1, be sure to check it out for an overview of the key components, design principles, and architectural models that define Zero Trust.

Zero Trust is more than a buzzword — it’s a foundational shift in cybersecurity architecture. In this episode of The CISO Perspective, we break down Zero Trust Architecture (ZTA) — defined by NIST SP 800-207 — into plain, actionable language. Topics Discussed: The core principles and components of Zero Trust: “never trust, always verify”Core tenants and requirements of a Zero Trust Architecture (ZTA)Real-world use cases and deployment strategies that make ZTA approachable for security leadersNew episodes every week. Subscribe to The CISO Perspective for more insights on cybersecurity, AI, and emerging tech.

In this video, we break down the Cyber Kill Chain model — a proven defensive cybersecurity strategy originally developed by Lockheed Martin.What you’ll learn:The seven stages of the Cyber Kill Chain: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on ObjectivesPractical defense tactics for each stage to help you stop cyberattacks before they escalateAnalysis of real-world examples and strategic tips for enhancing incident responseWhether you’re a security leader or just curious about how cyber defenders stay one step ahead, this video makes complex concepts easy to understand.Watch more videos on advanced security frameworks, threat intelligence, and strategic defense by subscribing to our channel.