---
title: "Two‑Factor Authentication (2FA)"
id: "31820"
type: "glossary"
slug: "two-factor-authentication-2fa"
published_at: "2026-06-05T13:36:05+00:00"
modified_at: "2026-06-08T13:18:07+00:00"
url: "https://www.kitecyber.com/glossary/two-factor-authentication-2fa/"
markdown_url: "https://www.kitecyber.com/glossary/two-factor-authentication-2fa.md"
excerpt: "Two‑Factor Authentication (2FA) Home / Glossary Index / Alphabet T What is Two‑Factor Authentication? Two‑Factor Authentication (2FA) requires users to provide two […]"
---

# Two‑Factor Authentication (2FA)

[Home](https://www.kitecyber.com/)
 / [Glossary Index](https://www.kitecyber.com/glossary/endpoint-security-terms/)
 / Alphabet T

## What is Two‑Factor Authentication?

**[Two‑Factor Authentication (2FA)](https://www.kitecyber.com/glossary/two-factor-authentication-2fa/)** requires users to provide two separate authentication factors before gaining access to a system. The factors must span across these distinct categories:

- **1. Something you know:** A password, PIN, or passphrase.
- **2. Something you have:** A mobile phone, hardware token, or smart card.
- **3. Something you are:** Biometrics like fingerprints or facial recognition.

## Types of 2FA (Ranked by Security Level)

| Method | How It Works | Security Level | Risk Profile |
| --- | --- | --- | --- |
| SMS Text | Code sent via carrier network | 🔴 Low | Highly vulnerable to SIM swapping and interception. |
| Email Codes | Code sent to email inbox | 🔴 Low | Vulnerable if email account itself is compromised. |
| TOTP Apps | Time-based code (Google Auth) | 🟡 Medium | Safe from SIM swaps, but vulnerable to proxy phishing. |
| Push Notes | Approve via prompt on device | 🟡 Medium | Vulnerable to user “MFA fatigue” approval spam. |
| Hardware Keys | FIDO2 Physical key (YubiKey) | 🟢 High | Cryptographically phishing-resistant. |

## NIST Deprecates SMS 2FA

The National Institute of Standards and Technology (NIST) has officially deprecated SMS for two‑factor authentication. Due to the high frequency of SIM-swapping attacks and network interception, text-based codes are no longer considered acceptable for enterprise defense.

[Request a Demo](https://www.kitecyber.com/request-a-demo/)