Security & Compliance · Engineering, IT & AI
Should you build or buy Multi-Factor Authentication (MFA)?
Multi-Factor Authentication (MFA) software requires users to verify their identity with at least two factors — typically something they know (password), something they have (phone or hardware key), or something they are (biometric). It covers TOTP codes, push notifications, FIDO2/WebAuthn hardware keys, SMS OTP, and adaptive risk-based authentication that adjusts requirements based on context.
The build-vs-buy decision for MFA turns on whether MFA is the right boundary to evaluate at all or whether the decision belongs at the identity platform level, and how the commodity pricing of commercial MFA compares against the operational overhead of self-hosting an open-source alternative; the specifics decide it.
Build it, buy it, or bridge?
When building makes sense
Building your own MFA infrastructure makes sense primarily as part of a broader decision to self-host your identity platform rather than as a standalone MFA choice. Platforms like Keycloak, Authentik, ZITADEL, and privacyIDEA are all in documented production as full MFA infrastructure, covering TOTP, WebAuthn, push authentication, SMS OTP, and hardware keys. For organizations with strict data-residency requirements or those that have already decided to run their own IdP, MFA comes along naturally. The case gets weaker when evaluated in isolation: independent analysis consistently shows that in-house authentication projects miss deadlines, frequently ship reduced scope, and the total cost of engineering the platform often exceeds what commercial tools charge. The more interesting engineering question in this category is usually adaptive risk logic — determining when to step up authentication based on behavioral signals — which is where custom work genuinely differentiates.
When buying makes sense
Buying MFA is the sensible default for most organizations because the commodity tier of the market is very cheap or free. Microsoft Authenticator is bundled into Entra ID at no additional cost for most Microsoft customers. Duo provides predictable per-user pricing with solid compliance documentation. Yubico hardware keys sit outside the software question entirely. The economics strongly favor buying: independent research shows the total cost of a well-engineered CIAM platform undercuts the engineering time it would replace, and 38% of in-house authentication projects ship reduced scope. The more meaningful question for most teams is whether MFA should be evaluated at all as a separate decision, or whether it should simply be part of the identity platform choice — because once you've decided on Entra ID or Okta, MFA is a configuration decision, not a procurement one.
The desk read
MFA is deep in commodity territory. Microsoft Authenticator is bundled into Entra ID at no additional cost for most Microsoft customers. Duo sits at a predictable per-user price. The open-source alternatives, Keycloak, Authentik, ZITADEL, and privacyIDEA, cover TOTP, WebAuthn, hardware keys, and push authentication in documented production deployments. Self-hosting one of these is a legitimate choice for privacy-sensitive or developer-focused organizations.
The build case is weakest on pure economics. Independent analysis consistently shows that in-house authentication projects miss their launch dates and frequently ship reduced scope, and the total cost of a well-engineered CIAM platform undercuts the cost of the engineering time it replaces. The more interesting question is whether MFA is even the right boundary to evaluate: for most organizations, MFA is inseparable from SSO policy and adaptive risk logic, and the decision should be made at the identity platform level rather than the MFA feature level. Yubico hardware keys and RSA SecurID sit outside that question entirely.
Vendors in Multi-Factor Authentication (MFA)
Each file covers what the product is, its funding history, and when the index last verified it alive.
Frequently asked
What is Multi-Factor Authentication (MFA)?
MFA software requires users to verify their identity with at least two factors — typically a password plus a phone or hardware key. It covers TOTP codes, push notifications, FIDO2/WebAuthn hardware keys, SMS OTP, and adaptive risk-based authentication that adjusts requirements based on context.
When does building MFA make sense?
Building makes sense primarily as part of a broader decision to self-host an identity platform. Open-source options like Keycloak and privacyIDEA cover the full MFA method set in production, but in-house builds frequently miss deadlines and ship reduced scope when evaluated independently.
When does buying MFA make sense?
Buying is the default for most organizations because Microsoft Authenticator is bundled free for M365 customers, Duo provides reliable per-user pricing, and commercial platforms absorb the ongoing passkey and WebAuthn standards evolution automatically.
What are the main MFA vendors?
Representative vendors include Microsoft Authenticator, Yubico, Duo (Cisco), RSA SecurID. B4 Pro scores the full set.
What is FIDO2/WebAuthn and why does it matter for MFA?
FIDO2 and WebAuthn are open standards for passwordless and hardware-key authentication that eliminate phishing risk entirely, since credentials never leave the device. Commercial MFA platforms absorb standard updates automatically; teams running self-hosted identity need to track this evolution manually.