platform / mfa

MFA on the logins your IdP can't see.

A second factor on Active Directory, database, and network logins, using the MFA app your users already have.

Book a demoSee how it works ↓
Works on
  • Kerberos
  • NTLM
  • LDAP
  • SMB
  • PostgreSQL
  • MySQL
  • RADIUS
Live login · Kerberoslive
  1. 09:14:02.118 · kerberos · AS-REQRequest
  2. 09:14:02.140 · dc-sensor · awaiting MFAHeld
  3. 09:14:06.902 · push · iPhone 15Approved
  4. 09:14:06.915 · dc-sensor · TGT issuedAccess granted

4.8s from sign-in to access

At a glance

A second factor on logins your IdP can't see, using the app your users already have.

What it does

Adds a second factor to AD, RDP, SSH, database and VPN logins.

What it replaces

Nothing.

It sits in front of AD, databases, and network gear. No rip and replace.

What you need

One lightweight component for each path you protect.

DC Sensor for Active Directory, DB agent for Databases, RADIUS Bridge for RADIUS / VPN.

Coverage

What MFA covers

01push held at DC

Push held at the DC

The login waits at the domain controller until the user approves.

kerberos → hold → push → TGT
02bring your own

Bring your own Duo or Okta

Keep the MFA app you already pay for.

provider: wallet | duo | okta
03database connect

MFA on database connect

Database logins get a push before the connection opens.

$ psql -h prod-db -U a.khan → push → connected
04enrollment

Enrollment

Users enroll themselves in under a minute.

status: pending → registered
Factor matrix

Which factors work where

protocolwallet pushduookta verifyfido2 keytotp code
AD & Windowsdc sensor
kerberosNeeds the DC SensorNeeds the DC SensorNeeds the DC Sensor
ntlmNeeds the DC SensorNeeds the DC SensorNeeds the DC Sensor
rdpNeeds the DC SensorNeeds the DC SensorNeeds the DC Sensor
Linuxssh gateway
sshNeeds the SSH gatewayNeeds the SSH gatewayNeeds the SSH gateway
sudoNeeds the SSH gatewayNeeds the SSH gatewayNeeds the SSH gateway
Databasesdb agent
postgresqlNeeds the DB agentNeeds the DB agentNeeds the DB agent
mysqlNeeds the DB agentNeeds the DB agentNeeds the DB agent
Networkradius bridge
radiusvpn, wi-fiNeeds the RADIUS BridgeNeeds the RADIUS BridgeNeeds the RADIUS Bridge
AuthNull consoleadmin sign-in
console sign-in

updated 2026-10-22 · source: product

How it fits

How a login gets its second factor

  1. 1user → system

    The login starts as normal.

  2. 2component → authnull

    The login is held while AuthNull asks for the second factor.

  3. 3authnull → mfa app

    A push or a prompt on the user's phone.

  4. 4authnull → component → siem

    Approve or deny, then the decision goes to your SIEM.

Rollout

Live in an afternoon

Most teams enforce MFA on a pilot group the same afternoon, after a short run in audit mode.

  1. Step 01: Connect Active Directory

    ~ 10 min

    Point AuthNull at your domain and choose which groups and OUs to sync.

  2. Step 02: Install the DC Sensor

    ~ 15 min

    Install the sensor on your domain controllers. Nothing goes on workstations.

  3. Step 03: Enroll users

    ~ 1 min per user

    Users install Wallet or keep Duo or Okta, and register their factor.

  4. Step 04: Start in audit mode

    as long as you need

    Policies log what they would do without prompting anyone, so you can check the impact first.

  5. Step 05: Set policy

    ~ 15 min

    Choose who must use MFA, starting with domain admins.

  6. Step 06: Enforce

    same day ✓

    Switch the policy to enforce. Logins wait at the DC until the user approves.

Proof

Evidence for your auditors

AuthNull's policies and logs help you show MFA and access controls for common frameworks.

  • PCI DSS 4.0

    8.4

    MFA for all access into the cardholder data environment.

    AuthNull evidence
    • MFA policies
    • Auth logs

  • CMMC

    IA.L2-3.5.3

    MFA for privileged and network access.

    AuthNull evidence
    • MFA policies
    • PAM sessions
    • Auth logs

  • SOC 2

    CC6.1

    Logical access controls.

    AuthNull evidence
    • Policy decisions
    • Auth logs

  • Cyber insurance

    Questionnaires

    MFA on admin and remote access, as insurers ask.

    AuthNull evidence
    • RADIUS MFA
    • PAM MFA

AuthNull supports evidence collection for these controls. It does not certify compliance on its own.

FAQ

Questions teams ask

Setup

  • No. Your IdP keeps handling cloud apps. AuthNull adds MFA to the logins it can't see: AD, servers, databases and network gear.

  • No. It uses AD for authentication and adds MFA in front of the systems behind it.

  • No. The DC Sensor runs on domain controllers only.
Users and factors

  • Yes. Bring your own provider, or use Wallet.

  • For signing in to the AuthNull console, yes: FIDO2 keys and TOTP codes both work. For AD, server, database and network logins, use Wallet, Duo or Okta Verify push.

  • See the factor matrix above. It is the single source of truth for supported factors.

Book a demo

See AuthNull on your own environment, in a 20-minute walkthrough with an engineer.

What happens next
  1. You send the formTwo minutes: who you are and what you want to protect.
  2. We reply within a dayAn engineer emails you to pick a time.
  3. A live 20-minute demoShown against your setup, with time for questions.
What do you want to protect?

By submitting you agree to our Terms and Privacy Policy.