Protegy dataset report · 2026-07-31
The state of two-factor authentication in 200 services
An analysis of the service capability records used by the Protegy Security Observatory. Counts describe listed availability, not adoption by individual users.
of services in the dataset list U2F or a security-key method, while 45% still list SMS.
Method coverage
What the dataset suggests
TOTP remains the common baseline
Every service selected for this catalog lists TOTP, which makes a standard authenticator broadly compatible.
Phishing-resistant coverage is narrower
Security-key support appears in 47 records. Users should prefer it for high-risk accounts when available.
Fallback channels remain common
SMS, calls, and email can help recovery, but they introduce phone-number and mailbox dependencies that users need to secure separately.
Capability is not configuration
A service may offer a strong method without users enabling it. The page-level guides focus on completing setup and saving recovery options.
Sources and limitations
Capability records are sourced from 2FA Directory and linked official documentation. Interface labels, regional rollout, account tiers, and recovery rules can change. Protegy shows the review date and invites corrections rather than presenting the dataset as live service status.
2FA Directory ↗