Why a password on its own is no longer enough
Passwords are stolen through phishing, reused from breaches on other sites and guessed by automated attacks that try thousands of them a minute. The issue is not how complex the password is: it is that a single piece of information, however secret, can always end up in the wrong hands without anyone noticing straight away.
Multi-factor authentication (MFA) adds a second check that is independent of the password: even if the password is stolen, whoever uses it cannot get in without the second factor too. It is probably the security measure that gives the most protection for the least cost to introduce.
The three factors, and how they combine
An authentication factor belongs to one of three categories: something you know (a password, a PIN), something you have (a smartphone, a physical key), something you are (a fingerprint, your face). MFA combines at least two different categories: a password plus a smartphone, for example, not a password plus a PIN, which belong to the same category and so fail together.
Types of MFA, from weakest to strongest
| Method | How it works | Main limitation |
|---|---|---|
| SMS code | A code sent to your phone by text message | Vulnerable to SIM swapping and interception: avoid where possible |
| Authenticator app (TOTP) | A temporary code generated by an app | A good compromise, but the code has to be typed in every time |
| Push notification | Approval with a single tap in the app | Convenient, but prone to "notification fatigue" if the user approves without thinking |
| Physical security key (FIDO2/passkey) | A physical device or a passkey tied to the device | The strongest option, and phishing-resistant; requires a dedicated device or system support |
You do not need the perfect method everywhere. You need something better than a password alone everywhere, and the strongest method possible on the most critical access.
Where to start the rollout
- Administrative and privileged accounts first: these are the ones that do the most damage if compromised.
- Email and Microsoft 365: often the starting point from which an attacker takes over everything else, by resetting the other passwords.
- Remote access, VPN and remote desktop: the most common way in for attacks that start from outside the company.
- Backup and infrastructure management consoles: if an attacker reaches them, they can attack the backups too.
- All other accounts, with a simpler method if needed so as not to hinder adoption, but enabled all the same.
The most common objections, and how to address them
The most frequent reaction is "it slows work down". This concern can be eased with practical choices: push notifications instead of codes to type, single sign-on that extends MFA to several services with a single check, and "adaptive" MFA that asks for the second check only when something is unusual, such as a login from a country never seen before, rather than at every single login.
You also need to plan for the exception: what happens when someone loses their phone. That calls for a recovery procedure verified by a person, not an unsupervised option that becomes the first thing an attacker tries to exploit.
Why insurers now ask for it too
More and more cyber insurance policies make MFA a minimum condition of insurability, particularly on remote access and administrative accounts: insurers have seen from the claims they handle how many breaches start from a stolen password with no second check. For the same reason, MFA is one of the practical pillars of any move towards Zero Trust.
Quick checklist
- MFA is enabled on all administrative and privileged accounts;
- MFA is enabled on email, Microsoft 365 and remote access (VPN, remote desktop);
- where possible, I avoid SMS as the only second factor;
- there is a verified procedure for recovering access if a smartphone is lost or stolen;
- I know whether my cyber insurer requires MFA as a condition of cover.
In short
MFA adds a second check independent of the password, and blocks most attacks that exploit stolen or reused credentials. It is introduced in phases, starting with the most critical accounts, using the strongest method possible and with a recovery procedure ready for exceptions.