- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
In 2025 and into 2026, one of the fastest-growing attack vectors targeting Indian enterprises has little to do with zero-day exploits or sophisticated malware. It starts with a simple push notification on an employee’s phone — and ends with a threat actor holding the keys to your Microsoft 365 tenant, your ERP system, or your cloud console. Multi-factor authentication (MFA) fatigue, also called push-bombing, has emerged as one of the most effective account-takeover techniques in the modern threat actor’s playbook.
For Indian CISOs, the implications are significant. The DPDP Act mandates robust data protection controls, and CERT-In’s directions require incident reporting within six hours. Yet many organisations still rely on legacy push-based MFA that provides a single, easily bypassed authentication layer. Understanding how MFA fatigue works — and why identity-centric Zero Trust is the right counter — is now a board-level conversation.
MFA fatigue exploits a fundamental human weakness: users who receive repeated authentication requests will eventually approve one — whether out of frustration, confusion, or a mistaken belief that the request is legitimate. The attack chain typically looks like this:
What makes push-bombing particularly dangerous is that it requires no malware on the endpoint, no vulnerability exploitation, and no technical sophistication beyond having a working credential pair. Identity becomes the perimeter — and it is failing.
Indian enterprises face a specific combination of risk factors that amplify MFA fatigue exposure:
Indian corporate email addresses regularly appear in global credential leak databases. Dark web marketplaces list access to Indian enterprises across BFSI, pharmaceutical, manufacturing, and IT services sectors. Once valid credentials are in an attacker’s hands, push-bombing is the natural next step — it requires no additional tools.
The accelerated adoption of hybrid work across Indian enterprises has expanded the authentication perimeter dramatically. Employees authenticate from home networks, mobile data connections, and shared Wi-Fi — each authentication event generating a push notification on a personal device that may not be under MDM control. Security teams have limited visibility into where authentications are originating.
Many Indian organisations — particularly mid-market enterprises — operate lean IT teams stretched across multiple responsibilities. SOC analysts monitoring authentication anomalies in real time are the exception rather than the rule. Without automated detection, a sustained push-bombing campaign can run for days before being noticed.
As Indian enterprises accelerate cloud adoption — AWS, Azure, GCP, and a growing ecosystem of SaaS applications — each cloud console represents a high-value target accessible directly from the internet with only credentials and an MFA approval standing between attackers and sensitive data or infrastructure control.
Push notification MFA was a significant improvement over password-only authentication, but it was designed for a different threat model. The core problem is that it delegates the final authentication decision to the user — and users are not security tools. They make mistakes, especially under social engineering pressure.
More robust alternatives exist and are increasingly accessible for Indian enterprises:
However, even robust MFA alone is insufficient if there is no continuous verification of device posture, network context, and user behaviour after initial authentication. This is where Zero Trust Network Access (ZTNA) becomes critical.
Zero Trust’s foundational principle — never trust, always verify — applies equally to authentication as to network access. An identity-centric ZTNA architecture extends verification beyond the initial login event to every session, every resource request, and every access decision.
In a traditional VPN model, once a user authenticates, they gain broad network access for the duration of the session. ZTNA inverts this: access is granted per-application, for specific time windows, based on real-time evaluation of identity, device health, network context, and behavioural signals. A compromised session is contained — even if an attacker successfully completes an MFA fatigue attack, they gain access to one application, not the entire internal network.
For organisations running FortiGate next-generation firewalls — the most widely deployed NGFW among mid-to-large Indian enterprises — Fortinet’s ZTNA implementation integrates directly with Microsoft Entra ID (formerly Azure AD) and other identity providers to enforce conditional access policies at the network gateway level. This means:
Even with strong MFA and conditional access, detection remains critical. Identity Threat Detection and Response (ITDR) capabilities — increasingly integrated into modern SIEM and SOAR platforms — allow SOC teams to correlate authentication telemetry with other signals: endpoint behaviour, cloud activity logs, email gateway events, and threat intelligence feeds. A push-bombing campaign that fails to achieve an approval still generates anomalous authentication patterns that should trigger alerts.
MFA fatigue attacks succeed when security teams lack the visibility to detect a sustained campaign before a user approves a malicious push request. For enterprises running a PJ Networks managed security engagement, we deploy and operate PrahiX Ora — a unified SecOps platform built by PrahiX Tech Pvt Ltd — to provide exactly this kind of cross-domain visibility.
PrahiX Ora’s four operational pillars each address a specific gap that attackers exploit:
SIEM: Ora’s SIEM ingests authentication logs from Microsoft Entra ID, Okta, on-premises Active Directory, and cloud provider control planes alongside network, endpoint, and application event streams. Correlation rules mapped to the MITRE ATT&CK framework — specifically the Initial Access and Credential Access tactics — surface push-bombing campaigns as high-confidence alerts rather than noise. Graph-based attack storyline reconstruction connects the dots between repeated failed MFA events, geolocation anomalies, and downstream access attempts in a visual timeline that enables rapid triage. For enterprises under CERT-In’s 180-day in-country log retention direction, Ora’s tiered hot/cold/archive retention ensures audit-ready log availability without runaway storage costs.
NMS: Network visibility complements identity telemetry. Ora’s NMS provides unified observability across FortiGate firewalls, switches, wireless access points, and WAN/SD-WAN links — with LLDP/CDP-based topology discovery that maps exactly which device a user is connecting from. When an authentication attempt originates from a device or network segment that has never been seen before, the NMS correlation flags it immediately. ML-based anomaly detection identifies unusual traffic patterns — for example, a user session that immediately begins enumerating file shares or exfiltrating data — that may indicate a post-authentication compromise even after a successful MFA bypass. This is especially valuable for Indian enterprises with complex multi-vendor estates where NOC visibility has historically been fragmented across separate management consoles.
Video Surveillance (VMS): For manufacturing sites, retail chains, and multi-site enterprise campuses, physical and logical security events need to be correlated. Ora’s video surveillance (VMS) module manages ONVIF/Hikvision/Dahua cameras with integrated video analytics — meaning a suspicious after-hours authentication event can be automatically cross-referenced against camera footage from the corresponding physical access point. If an authentication attempt occurs at 2 AM from a device registered to a factory floor, but the camera shows no physical presence, that discrepancy becomes part of the incident timeline under one operations view rather than two separate investigations.
SOAR: When Ora’s SIEM detects a push-bombing campaign in progress — for example, a single user account generating more than fifteen failed MFA attempts within thirty minutes — the SOAR module can execute a pre-built response playbook automatically: disabling the account in Active Directory, pushing a blocklist entry to FortiGate to deny further access attempts from the source IP, and generating a CERT-In formatted incident report template. This matters enormously given CERT-In’s six-hour incident reporting window — automated response is not a convenience, it is what makes compliance with that timeline realistic for a lean security team.
If your organisation is evaluating a unified SecOps platform to close the identity visibility gap, contact PJ Networks to discuss a PrahiX Ora deployment assessment.
Defending against MFA fatigue requires changes at the technology, process, and people levels. Here is a practical checklist for Indian enterprise security teams:
For Indian enterprises managing compliance obligations, MFA fatigue incidents carry specific regulatory implications:
Under CERT-In’s 2022 directions, a successful account compromise — regardless of how it was achieved — constitutes a cybersecurity incident that must be reported within six hours of detection. The six-hour clock starts at detection, not at the time of the attack, which means organisations that lack real-time authentication monitoring may discover an incident hours or days after the fact, severely compressing the response window.
The DPDP Act requires organisations to implement appropriate technical and organisational measures to protect personal data. An authentication architecture that relies on push-based MFA without anomaly detection or conditional access controls is increasingly difficult to defend as “appropriate” when industry best practices — number matching, ZTNA, ITDR — are widely available and not cost-prohibitive. While implementing these controls does not make an organisation “DPDP compliant” in itself, the absence of them in the event of a breach creates meaningful regulatory exposure.
Proactively documenting your authentication architecture, detection capabilities, and incident response procedures — and being able to evidence these to CERT-In or the Data Protection Board — is a key governance step that many Indian enterprises have not yet taken.
PJ Networks provides Indian enterprises with a managed security framework built specifically to address identity-centric threats like MFA fatigue:
If your organisation is assessing its identity security posture or wants to understand whether your current MFA implementation is vulnerable to fatigue attacks, contact PJ Networks for a no-obligation authentication architecture review.