If there’s one security measure we’d ask every small business to put in place, it’s multi-factor authentication, usually shortened to MFA. It isn’t glamorous, it doesn’t involve expensive equipment, and it blocks a very common way in.
How accounts actually get compromised
Most successful attacks on small businesses don’t involve clever technical wizardry. They start with a password. Passwords get stolen through phishing emails that look convincing, reused across sites that later suffer a breach, guessed because they’re weak, or simply typed into a fake login page.
Once an attacker has a working password for a mailbox, they can read email, send messages as that person and request password resets for other services. A common pattern is to use a compromised account to send convincing invoice or payment-change requests to your own customers and suppliers.
What MFA does
MFA adds a second proof of identity. Alongside something you know (the password), you also need something you have (a phone or a security key) or something you are. If a criminal has only the password, they’re stopped at the second step.
It isn’t perfect, and we’ll come to that. But it turns a stolen password from a skeleton key into a part of a lock.
Not all MFA is equal
- Text message codes are better than nothing, but can be intercepted or redirected, so we treat them as a last resort.
- Authenticator apps generate a code or ask you to approve a sign-in. They are a sensible default for most businesses.
- Number matching in an authenticator app asks you to type a number shown on the login screen, which makes it much harder to approve a request by accident.
- Passkeys and security keys are the strongest option. They are resistant to phishing because they only work on the genuine site.
For most small businesses, an authenticator app with number matching is the practical choice today, with security keys or passkeys for the most sensitive accounts such as administrators.
Where to start
You don’t need to protect everything on day one. Prioritise in this order:
- Administrator accounts for Microsoft 365, your domain registrar, your firewall and any cloud platform
- Email for everyone, because email is the gateway to resetting everything else
- Remote access: VPNs, remote desktop and any way into your network from outside
- Finance, payroll and other systems that handle money or personal data
- Everything else, over time
Rolling it out without a revolt
MFA fails most often because it’s introduced badly. People feel it’s been done to them. A few simple habits help:
- Explain the reason in two minutes: “someone could pretend to be you, and this stops them.”
- Give clear, short instructions with screenshots, and set a date.
- Be on hand during the first week, because most problems are in the first few sign-ins.
- Decide in advance what happens when someone loses or replaces their phone.
- Avoid “prompt bombing”: if someone gets a flood of approval requests they didn’t trigger, they should know to refuse them and report it.
Common objections
“It’s annoying.” A few extra seconds on sign-in, usually not every time on a trusted device. Compare that with a compromised mailbox.
“We’re too small to be a target.” Attackers favour easy, repeatable attacks at scale. A small business without MFA is exactly that.
“It’ll cost a lot.” Often the capability is already included in what you’re paying for. It just needs switching on and configuring properly.
If you’re not sure where you stand, we can check your Microsoft 365 and other key accounts and tell you honestly what’s protected and what isn’t.