If you only do one thing to improve your business security this year, make it this. Multi-factor authentication — MFA — is widely regarded as the single most effective step a small business can take to stop accounts being hacked, and it's usually free to switch on. Here's what it is and why it matters so much.
What MFA actually is
Normally you log in with just a password — one thing you know. The problem is that passwords get stolen, guessed, reused and leaked all the time. MFA adds a second step: as well as your password, you confirm it's really you with something else, usually a code from an app on your phone or a tap to approve. So even if a criminal has your password, they can't get in without that second factor — which is sitting in your pocket.
You've almost certainly used it already: when your bank texts you a code, that's MFA. The same idea protects your email, Microsoft 365, accounting software and more.
Why a password on its own isn't enough anymore
Billions of stolen passwords are floating around online from years of data breaches. People reuse the same password across multiple sites, so one leak exposes everything. Attackers use automated tools to try these passwords against business accounts by the million. If your email is protected by a password alone — especially one you've used elsewhere — you're relying on luck. MFA removes the luck.
The different types of MFA (and which to use)
- Authenticator app — a free app (like Microsoft Authenticator) generates a code or sends an approval prompt. This is the sweet spot for most businesses: secure and easy.
- Text message codes — better than nothing and very simple, though slightly less secure than an app. Fine as a starting point.
- Hardware keys — a physical device you plug in or tap. The most secure option, used where security is critical.
For most small businesses, an authenticator app on everyone's phone is the right balance of strong and simple.
"But won't it slow my team down?"
This is the usual objection, and it's overblown. After the first setup, MFA usually means one quick tap on your phone — and on trusted devices you often won't be prompted every single time. Weigh a couple of seconds at login against the days of chaos, lost data and reputational damage of a hacked email account, and it's no contest. The friction is tiny; the protection is enormous.
Getting MFA set up properly
MFA is most valuable on your email and Microsoft 365 first, since email is the key to resetting everything else. It's worth rolling out across the business consistently rather than leaving gaps. We set this up for North East businesses as part of our cybersecurity and Microsoft 365 work — switched on cleanly, with your team shown how to use it, so it protects you without causing daily friction.