MFA: why a password is no longer enough

Passwords leak through third-party breaches, get guessed when reused, get stolen through phishing and get tried by the millions in automated attacks. Even a “good” password no longer protects an important account on its own: it only needs to have been used on one compromised site to be tried elsewhere.

Multifactor authentication (MFA) adds a second proof — something you have (phone, security key) or something you are (fingerprint) — on top of the password. An attacker who steals the password remains blocked, because they lack the second factor.

Not all MFA is equal. A text-message code is better than nothing but remains vulnerable to SIM swapping and interception. An authenticator app (Microsoft Authenticator, Google Authenticator or equivalent) generates time-limited local codes: the right standard for a small business. Physical security keys and so-called phishing-resistant methods offer the highest level for critical accounts.

Announce the change, set a date, walk each workstation through setup and plan a recovery method (recovery codes stored safely, a trusted backup phone). The main pitfall is not technical: it is the employee who loses their phone with no fallback and gets locked out of their tools.

In Microsoft 365, MFA is enforced through security policies rather than individual goodwill. SolutionsCW configures these policies, documents recovery methods and verifies that no account — including service accounts — is left unprotected.

MFA does not replace updates, backups or phishing vigilance: some recent attacks try to get the victim to approve the sign-in themselves (notification fatigue). The rule is simple: never approve a sign-in request you did not initiate yourself, and report repeated prompts to your support.