In short
- MFA blocks the way most real attacks on small businesses begin, and usually costs nothing beyond the rollout.
- Only one setting counts: enforced, with no exemptions.
- MFA is a layer, not the whole plan. Some attacks never touch a login.
- Start with email and finance, prefer an authenticator app or passkeys, and write down the recovery process.
If you only ever implement one security control, make it multi-factor authentication. MFA is the rare case where the cheapest fix and the most effective fix are the same fix. It directly blocks the way most real attacks on small businesses begin, and for most companies it costs nothing beyond the rollout effort.
That is the whole pitch. The rest of this article explains what MFA actually is, the gap between “we have it” and “it would have saved us,” and the ways attackers work around lazy implementations.
What Multi-Factor Authentication Is, Without the Jargon
Signing in with a password proves one thing: you know a secret. Secrets leak. People reuse them across sites, type them into convincing fakes, and pick ones software can guess. When a breach makes the news, stolen credentials are usually the opening move.
MFA adds a second, different kind of proof. Something you have, like your phone or a hardware key, or something you are, like a fingerprint. An attacker overseas can buy your password for a few dollars. Your phone stays in your pocket. That physical fact is the entire trick, and it works remarkably well. The overwhelming majority of credential-based attacks die at the second factor, which is why insurers ask about MFA before almost anything else.
“We Have MFA” Can Mean Three Different Things
Here is where businesses stay exposed while believing they are covered. Only one of these three states counts:
- Available. The platform supports MFA. Every modern platform does. This protects nobody.
- Encouraged. Most people turned it on after the email asking nicely. Attackers do not log in as most people. They log in as the one shared mailbox, the semi-retired partner, or the service account from 2019 that nobody wanted to break.
- Enforced. A policy makes sign-in impossible without a second factor. No optional paths, no seniority exemptions, no forgotten warehouse computer. Enforcement is the only state that means anything, and it is what the word “enforced” on your insurance application legally represents.
Every MFA rollout produces requests for exceptions, and the requests come from exactly the accounts attackers most want. Owners and executives say they are too busy. Shared mailboxes raise the question of whose phone would ping. Old service accounts might break. Every exemption is a documented, discoverable hole, and the owner's mailbox is the single most valuable mailbox in the company.
Only one of the three counts
- Does not count: Available
- Does not count: Encouraged
- Counts: Enforced
What MFA Does Not Stop
Overtrusting a control creates its own risk, so here are the honest limits:
- Session-stealing phishing. Modern phishing kits proxy the real login page, capture the second factor, and steal the signed-in session. Hardware keys, passkeys, and sign-in monitoring that notices impossible travel defend against this. MFA remains a layer rather than the whole plan.
- MFA fatigue. Attackers with a stolen password trigger push notifications until a tired employee taps approve. Number-matching prompts and training blunt the technique. The habit of approving anything that buzzes defeats it.
- Attacks that never touch a login. A fraudulent invoice from a compromised vendor, malware on an unpatched machine, or a backup nobody tested all bypass MFA entirely. MFA guards doors, and some threats come through windows.
How to Roll Out MFA Without a Mutiny
The resistance is real and manageable. Five steps:
Start with email and finance, enforced, no exceptions.
Email is the skeleton key to everything else. Banking and payroll are where money leaves.
Prefer an authenticator app or passkeys over text messages.
SMS codes beat nothing, and phone numbers can be hijacked. Use stronger methods where platforms allow.
Pair the rollout with a password manager.
Daily sign-ins get easier at the same time they get safer. Most MFA complaints are really friction complaints, and this trades friction down.
Set a deadline, then flip enforcement.
Voluntary adoption plateaus around 80%, and the remaining 20% contains every account an attacker would pick first.
Write down the recovery process.
The real operational cost of MFA arrives the day someone loses their phone. Decide in advance how identity gets verified and factors get reset. Without a written process, you will improvise under pressure, badly.
Have whoever runs your systems show you two things on screen: the policy that enforces MFA, and the list of accounts exempt from it. Showing beats telling. If the exemption list contains anything beyond documented break-glass accounts, you have found this quarter's most cost-effective security project.
Enforced MFA is one of the first things we verify in an assessment. For managed clients, it is simply the standing state of the world: enforced everywhere, exceptions documented, recovery process written down. Not sure which of the three states your business is in? The three-minute self-assessment will tell you, with no email address required.