The MFA solutions most often shortlisted by businesses are Cisco Duo, ESET Secure Authentication, LoginTC, Microsoft Entra ID, miniOrange, Okta, Protectimus, RSA ID Plus, Rublon, and Thales SafeNet Trusted Access. They differ most in deployment (cloud only or self-hosted), hardware token support, and VPN and Windows coverage. Published starting prices range from about $1.40 to $7 per user per month. How We Compared MFA Solutions Every vendor on this list does the basics: a second factor after the password, a mobile app, an admin console. The differences that decide a purchase sit elsewhere, so each solution was checked against the same criteria: Deployment. Cloud only, self-hosted on your own servers, or hybrid. Hardware tokens. Whether the vendor offers its own tokens, accepts third-party OATH tokens, or supports only security keys. OTP delivery methods. App, push, SMS, email, voice, messengers. Key integrations. VPN through RADIUS, Windows login and RDP, Microsoft 365, and on-premise directories. Pricing. Published starting price per user per month, free tier, minimums. Prices come from each vendor’s official pricing page. Where a vendor does not publish prices, the table says “Quote-based.” Features are taken from vendor product pages and documentation. Data checked: October 2026. MFA Solutions at a Glance Solution Deployment Hardware tokens OTP delivery methods Key integrations Free tier Starting price per user/month Best for Cisco Duo Cloud (on-prem proxy for RADIUS/LDAP) Duo-branded (D-100) and third-party OATH HOTP, YubiKey Push, app, SMS, voice, hardware token VPN/RADIUS, Windows login and RDP, Microsoft 365 Up to 10 users $3 (Essentials) Teams that want a cloud service with broad app coverage ESET Secure Authentication Cloud or on-premise Third-party Push, app, SMS, hardware token, FIDO VPN/RADIUS, Windows login, RDP, AD FS, web apps No Quote-based Companies already using ESET security products LoginTC Cloud or on-premise Supported (Professional and up) Push, app, SMS, email, voice, hardware token, security key VPN/RADIUS, AD/LDAP, Windows login and RDP (Business and up) Up to 3 users $3 (Cloud Professional) VPN-focused deployments that may need on-premise later Microsoft Entra ID MFA Cloud Third-party OATH TOTP Push, app, SMS, voice, hardware token, FIDO2 Microsoft 365, RADIUS through NPS extension MFA in Entra ID Free $7 (P1) Organizations standardized on Microsoft 365 miniOrange Cloud or on-premise Supported Push, app, SMS, email, hardware token, FIDO2 VPN and VDI, Windows/Mac/Linux login, Microsoft 365, AD FS, LDAP No (30-day trial) $2...
Managing remote access security requires a decision most teams avoid until something goes wrong: where exactly should MFA be enforced? At the network edge, or on the host itself? The answer isn’t binary — but getting the layer wrong means either leaving critical servers exposed after a perimeter breach, or blocking legitimate administrators from getting in when the network stack misbehaves. This article breaks down the two enforcement models, what each one actually protects, and when using both together is the right call. TL;DR / Quick Answer There are two distinct layers where MFA can be enforced in a Windows environment: Host-level MFA (Windows Credential Provider) intercepts authentication directly on the machine — at the Windows logon screen or during an RDP session. It protects the host regardless of how the user reached it. Works with NLA. Supports offline mode. Best for servers, jump hosts, and workstations. Network-level MFA (RADIUS proxy) enforces a second factor at the network edge for VPN, VDI, and other RADIUS-authenticated services before users reach internal resources. No agent required on individual hosts. Best for remote access and network perimeter. Strategy: most enterprise environments need both. Network-level MFA stops attackers at the perimeter; host-level MFA stops lateral movement after a perimeter breach. The Two Enforcement Layers The fundamental difference between host-level and network-level MFA comes down to where in the access chain the second factor is checked. Host-level MFA sits inside the operating system. A Credential Provider agent installed on a Windows machine intercepts the logon process — whether that’s a local console login or an inbound RDP session. The MFA check happens before the Windows shell loads, meaning an attacker who reaches the login screen still can’t get in without the second factor. Network-level MFA sits in front of your infrastructure. A RADIUS proxy receives authentication requests from a RADIUS-enabled service or device, validates the user’s password against Active Directory or LDAP, and then issues a second-factor challenge before returning an Access-Accept to the network device. The host never sees the unauthenticated connection attempt. Neither layer is a substitute for the other. A network-level MFA deployment alone does not protect Windows logon or direct RDP authentication on the target host. If an attacker reaches the login screen through another path, host-level MFA remains the final control preventing unauthorized access. And according to Mandiant’s 2026...
In response to new challenges, Protectimus has developed a powerful means of protection against auto-filling, injecting, and other types of malicious software that manipulates and modifies data during transactions. There are different ways in which such software can work; for example, the recipient is changed during a transfer as an unsuspecting user enters a one-time password sent via an SMS message. The problem is that this user...