SECAI Core · phase 10 of 15
Multifactor authentication
An authentication scheme that requires the user to present at least two different factors as credentials; for example, something you know, something you have, something you are, something you do, and somewhere you are.
The Explain card
- Plain English
- Multifactor authentication (MFA) requires at least two different kinds of credential: something you know (password), something you have (phone or key), something you are (fingerprint), something you do, or somewhere you are.
- Example
- Access to the console that manages production model weights requires a password plus a hardware security key. An attacker who phished an engineer's password still cannot log in and swap the model for a backdoored version.
- Why it matters
- AI admin consoles, API key stores and training pipelines are high-value targets. MFA turns a single stolen secret from a breach into a failed attempt.
- Hook
- Two locks, two different keys.
Where it sits in the deck
Phase 10: Identity, Access, and Cryptographic Foundations
Before examining threats to systems, establish the foundational security primitives — identity, authentication, authorisation, and the cryptography underpinning them.
