Imagine an employee works for a company where they can log into the company network with just a password (or alternatively, just an SSH key or TLS certificate).

Imagine an employee works for a company where they can log into the company network with just a password (or alternatively, just an SSH key or TLS certificate). If an attacker gets their hands on this credential, by any means, then the attacker can use that credential to log in. These kinds of attacks can happen remotely in a variety of ways. Phishing is just one way. Malware is another - perhaps the employee downloaded apparently legitimate software that had a credential stealing trojan within it (e.g. keylogger or SSH key slurp). Or maybe the employee used their same password at another website that's been compromised, despite being told not to. Or maybe the password is just a bad password and the attacker brute-forced it. An attacker who gains sufficient access to the right system can obtain your employee's credential, copy it, take it elsewhere, and use it later. They could use the employee's credential months later from anywhere in the world, and you could have difficulty identifying exactly how the credential was compromised originally, especially if time has passed and the attacker covered their tracks. Now imagine a different employee who works at a smart company where logging into the company network (and accessing all company systems) requires multi-factor authentication using U2F or OTP in addition to a password. The attacker might be able to steal the employee's primary credential, through whatever means, but they have absolutely no way to obtain the employee's U2F or OTP codes remotely and electronically. The attacker simply cannot get into the company systems without having access to the MFA. This substantially raises the bar for a successful attack, and provides a great defense against attacking the company network and systems. Yes, it's true that if you leave your MFA token in your laptop, then you could misplace your laptop and lose the token with it. In that scenario, though, the random attacker who discovers a random laptop in a cafe by chance won't know who it belongs to, or what company, and won't know the owner's password. Security is still preserved. The most plausible bad guy will sell the laptop to a pawn shop, not try to attack the owner's network. Furthermore, the employee should have been trained to call the IT helpdesk as soon as they realized their laptop and token were missing, cutting down the window for a successful attack. To mitigate the risk of random loss, you'll want to employ full disk encryption, and disable the username auto-fill. This way an attacker can't get anything from the device without signing in, and has no information about whom it might belong to. Employ a policy that locks the screen after a few minutes of inactivity to make it difficult for attackers to swipe idle but still signed in laptops. These precautions all together make it incredibly hard for an attacker to get in the front door. The only scenario in which security is compromised is if the employee's login credential has been compromised, and the same attacker has also physically stolen their MFA token. An attacker that is actively attempting to steal physical belongings from you in order to penetrate your organization is getting into Hollywood spy movie stuff. It's a real life concern for people doing certain types of work, to be fair, but those people usually mitigate the concern by keeping their equipment in secure facilities, and not taking their laptops to cafes to begin with.