The User Access Security Broker from Secfense analyzes both network traffic and front-end events. For a given application, the default 2FA method (cryptographic keys, TOTP codes, biometrics, etc.) is selected and placed between the user and the target application.
Regardless of the 2FA method, there are two processes: the registration process and the authentication process. In the registration process, we associate the attribute of the second component with a given account in the system (i.e. in the case of SMS codes, the user provides the telephone number and then enters the start code from the SMS). At the next login attempt, Secfense solution already knows the relationship of the user with the given attribute of the second component, performing its part of the task, and expects the correct code from the user. In the linked video, from around the 2-minute of the video, we have shown how this process works for cryptographic keys of the FIDO U2F standard (registration in the first step, and then authentication in the next steps).