If a business asked us to name the single control that would most reduce its risk for the least money and disruption, the answer would be multi-factor authentication. It is not close.
It is also the control that generates the most internal resistance, usually from people who have been told it will slow them down. That objection is worth taking seriously and answering properly, because a rollout that people work around is worse than one that never happened.
The problem MFA solves
Passwords fail in predictable ways, and none of them are really the user’s fault.
People reuse them across services, because remembering dozens of unique passwords is not a reasonable expectation. When any one of those services is breached, the credentials appear in collections that get tried automatically against other services. Passwords also get phished — typed into a convincing sign-in page that was not the real one. And they get guessed, when they follow the patterns people naturally choose.
The common thread is that a password is a single secret. Once someone else has it, they are you.
MFA breaks that. A second factor — something you have, rather than something you know — means a stolen password on its own is not enough.
What the attack actually looks like
It is worth being concrete, because “account compromise” sounds abstract.
Someone gets access to a business email account. They do not announce themselves. They read quietly for days or weeks, learning who pays whom, how invoices are worded, which supplier relationships exist, and when key people travel. They may set a mail rule that quietly moves certain messages out of the inbox.
Then they send one email from the real account, into a real thread, saying banking details have changed. It arrives from a genuine address, in a familiar tone, referencing a real project.
That attack is not sophisticated. It requires no malware. It requires a password — and MFA is what makes the password insufficient.
Not all second factors are equal
In rough order of strength:
- Hardware security keys — a physical key that must be present. Strongest option, and highly resistant to phishing because the key verifies the actual site. Worth the cost for administrative and finance accounts.
- Authenticator apps — a code or push approval on a phone app. Strong, free, and the right default for most staff. Number-matching, where you confirm a digit shown on screen, is preferable to plain approve/deny.
- SMS codes — better than nothing, and much better than a password alone. But SMS can be intercepted or redirected through the mobile carrier. Acceptable as a fallback; not the right choice for administrative accounts.
The gap attackers now targetPush notifications that only say “approve or deny” can be defeated by sending repeated prompts until a tired user taps approve. Number-matching closes that gap, and most platforms now support it. If your MFA is push-based, check whether number-matching is enabled.
Where to enable it first
You do not have to do everything at once. Order matters more than speed.
- Administrative accounts. Without exception. An unprotected admin account can undo every other control.
- Email. Email is the account that resets the others. Protecting it protects a great deal downstream.
- Remote access. VPN, remote desktop, anything reachable from outside your network.
- Financial systems. Banking, payroll, accounting platforms, payment tools.
- Everything else that supports it. Working through the remaining business applications systematically.
Answering the objection honestly
“This will slow everyone down” deserves a real answer rather than dismissal.
Configured well, most staff are prompted when signing in on a new device, or periodically on a trusted one — not every time they check email. The daily overhead for a typical user is close to zero once set up. The initial enrollment takes a few minutes per person.
What genuinely causes friction is a poor rollout: no warning, no help enrolling, no plan for someone who loses their phone, and no thought given to shared or role-based accounts. Those are solvable, and solving them in advance is what separates a smooth rollout from a resented one.
Doing the rollout properly
A few things worth planning before you start.
Tell people first, and say why. Not a policy announcement — a short explanation of the actual risk, ideally with the invoice-fraud example, which most people immediately recognize as plausible.
Help with enrollment. A scheduled session where people set it up with someone available to help removes almost all of the support burden.
Plan for lost devices. Decide in advance how someone gets back in when their phone is broken, stolen or replaced — and make sure that recovery path is not itself an easy way in for an attacker.
Handle shared accounts. Most businesses have a few. Work out whether they can become individual accounts with delegated access, which is almost always the better answer.
Consider conditional access. On Microsoft 365 and similar platforms, policies can require additional verification based on context — an unrecognized device, an unusual location, a sign-in from a country where you have no staff. This reduces prompts for routine work while tightening genuinely unusual sign-ins.
What MFA does not do
MFA closes one significant door. It does not close all of them.
It does not stop malware arriving through an attachment, protect against a vulnerability in software you run, prevent an already-authenticated session being hijacked, or help if someone is persuaded to approve a prompt they should have rejected.
It belongs alongside endpoint protection, email filtering, patching, sensible access control, tested backups and staff who know what to look for. What makes it exceptional is the ratio: minimal cost, minimal ongoing effort, and it closes off one of the most common paths into a small business.
If it is not enabled everywhere it can be, that is the next thing to do.
This article is general guidance and is not legal, regulatory or compliance advice. Technology and threats change — if you are making a decision based on it, check that it still reflects your current environment.