MFA stands for multi-factor authentication. It means that when someone signs in to an account, they need to verify their identity with two separate things, not just a password. A password plus a phone notification, for example.
Why a password alone is not enough
Passwords get stolen. Through phishing, data breaches at other websites, and credential stuffing attacks, attackers regularly acquire valid usernames and passwords for accounts they have never had legitimate access to. Once they have your password, a standard login screen just lets them in.
MFA means that even if an attacker has your password, they cannot get in without also having your phone, your authentication app, or your hardware key. Over 90% of account takeover attacks succeed against accounts without MFA and fail against accounts with it. That statistic alone makes MFA the single highest-impact security control available to a small business.
Types of MFA
Authenticator app
Microsoft Authenticator, Google Authenticator, or similar apps generate a time-based code. The strongest common option for most businesses.
SMS text code
A one-time code sent to your phone by text. Better than nothing, but weaker than an authenticator app because SMS can be intercepted.
Push notification
A prompt appears on your phone asking you to approve or deny the sign-in. Convenient and secure.
Hardware key
A physical device (like a YubiKey) that you plug in or tap. The strongest option available, used in high-security environments.
How to roll out MFA for your business
If you use Microsoft 365, MFA can be enforced via conditional access policies for all users. If you use Google Workspace, the same applies through the admin console. The process takes a few hours to configure properly and requires communicating the change to staff in advance.
The common objection is that staff will find it annoying. In practice, modern MFA implementations use persistent authentication on trusted devices, meaning staff only see the MFA prompt when signing in from a new device or after a timeout period. The daily friction is minimal.
If MFA is not enforced for every account at your business, that is the first thing we fix.
A free security assessment covers your current MFA state and what it would take to close the gap. Otto responds same day.
Get a free security assessment