If your business adopts exactly one security measure this year, make it multi-factor authentication. It’s inexpensive, it’s required by most cyber insurance carriers, and it defeats the single most common attack against small businesses: the stolen password.
The problem MFA solves
Passwords fail constantly, and usually through no dramatic hack of your systems. They fail because:
- An employee reuses their work password on a shopping site that gets breached, and that password ends up in a database attackers buy and try everywhere
- A convincing phishing page captures a login
- A password is guessable, written down, or shared
Once an attacker has a valid password, they don’t “break in” — they log in, looking exactly like your employee. From inside a single email account, they can read invoices, impersonate staff, redirect payments, and reset passwords on other systems.
MFA breaks this chain by requiring a second proof of identity that a stolen password can’t provide.
How it works
Authentication factors come in three flavors:
- Something you know — a password or PIN
- Something you have — your phone, an authenticator app, a hardware key
- Something you are — fingerprint or face
Multi-factor authentication just means requiring two different flavors. A password plus a code from your phone. A password plus a fingerprint. An attacker on another continent with your password now also needs your physical phone — and the attack collapses.
You’ll also see 2FA (two-factor authentication); it’s the same idea, and the terms are used interchangeably in practice.
Not all MFA is equal
From weakest to strongest:
| Method | How it works | Strength |
|---|---|---|
| SMS text codes | Code texted to your phone | Better than nothing, but vulnerable to SIM-swapping and phishing |
| Email codes | Code sent to email | Weak — circular if email is what’s compromised |
| Authenticator apps | Rotating 6-digit codes (Microsoft/Google Authenticator) | Good |
| Push with number matching | App shows a prompt; you type the number from the login screen | Very good — resists “prompt bombing” |
| Hardware keys / passkeys (FIDO2) | Physical key or device-bound credential; nothing to type or intercept | Strongest — phishing-resistant |
Two practical notes:
Avoid plain “Approve/Deny” push prompts. Attackers learned to spam users with prompts at 2 a.m. until someone taps Approve just to make it stop (“MFA fatigue”). Number matching — where you must type a code shown on the login screen — closes that hole, and Microsoft now enforces it by default.
Passkeys are where things are heading. They replace the password entirely with a cryptographic credential stored on your device and unlocked by fingerprint or face. They can’t be phished, guessed, or reused, and Microsoft 365 and Google Workspace both support them today. New deployments should have passkeys on the roadmap.
Where you need it
Prioritize in this order:
- Email (Microsoft 365 / Google Workspace) — email is the master key to everything else, because it can reset other passwords
- Remote access — VPN, remote desktop, and any way into your network from outside
- Financial systems — banking, payroll, accounting software
- Admin accounts — anyone with elevated privileges, everywhere, no exceptions
- Line-of-business apps — CRM, industry software, anything holding client data
If you use Microsoft 365, much of this can be enforced centrally through Conditional Access or security defaults, so it’s policy rather than a per-person favor.
“Will my staff hate it?”
This is the most common objection, and it’s aged badly. Done thoughtfully, MFA adds a few seconds to a handful of logins per week:
- Modern systems remember trusted devices, so people aren’t prompted constantly — mainly on new devices or unusual sign-ins
- Authenticator prompts take about three seconds
- Passkeys are genuinely faster than typing a password
Rollout advice: announce it ahead of time with a one-paragraph explanation of why (insurers require it; it protects everyone’s paycheck), give people a simple setup guide, run it department by department, and have someone available for questions the first week. Resistance almost always comes from surprise, not from the technology.
Plan for the practical wrinkles too: employees without company phones (authenticator apps work fine on personal phones without giving the company any access to them — or use inexpensive hardware keys), lost phones (IT needs a documented, identity-verified reset process), and shared accounts (which shouldn’t exist anyway — this is a good excuse to fix that).
The insurance angle
If you’ve filled out a cyber insurance application recently, you noticed the MFA questions — on email, on remote access, on admin accounts, on backups. Carriers ask because their claims data shows compromised credentials behind a large share of losses. Many will decline to write a policy without MFA, and answering inaccurately can give a carrier grounds to deny a claim when you need it most. If your renewal is coming up and MFA isn’t fully deployed, that’s your deadline.
The bottom line
MFA is the rare security control that is simultaneously cheap, fast to deploy, low-friction, and devastatingly effective against the most common attack pattern. Most businesses can go from “no MFA” to “MFA everywhere that matters” in a few weeks. If it’s not everywhere in your company yet, it’s the first conversation to have with whoever manages your IT.