For Cyber Security Awareness Month, one observation worth being direct about: MFA does not reliably stop phishing, and the gap between 'we have MFA' and 'we are protected against credential phishing' is significant.
The attacks that succeed against MFA-enabled organisations typically use adversary-in-the-middle techniques. The user enters their credentials and their one-time code on what appears to be a legitimate login page. Behind the scenes, those are relayed to the real site in real time, and the attacker captures a valid authenticated session. The MFA prompt was completed. The attacker still wins.
Phishing-resistant authentication methods - FIDO2 hardware security keys, passkeys, device-bound credentials - operate at a different level entirely. Authentication is cryptographically bound to the legitimate origin, so there is no token or code to intercept. These are not a harder version of the same control; they are a structurally different one.
For organisations still running TOTP or push-based MFA on high-value systems, the question isn't whether to move toward phishing-resistant methods - it's when and which systems to prioritise first.
And for staff: the right response to a suspicious email or login prompt is to report it, not to second-guess whether it meets some threshold of certainty. Reporting something that turns out to be benign costs nothing. Not reporting something that wasn't costs considerably more.