If you do one thing after reading this, make it this: turn on multi-factor authentication everywhere, starting with email.
It is the single highest-leverage security control available to a small business. Microsoft has stated that MFA blocks over 99% of automated account-compromise attempts. Almost every credential-based attack we investigate would have failed at the front door if MFA had been enforced.
Why a password alone fails
Passwords leak. They get reused across sites, phished through fake login pages, and dumped in breaches you'll never hear about. Once an attacker has a valid password, a system with password-only login has no way to tell them apart from you. MFA adds a second proof, something you have, like a phone app, so a stolen password isn't enough on its own.
"We already have it" usually means "we offered it"
Here's the catch we see constantly: MFA is available but not enforced. It's switched on for the owner, optional for everyone else, and quietly skipped by the half of the team that found it annoying. Optional MFA protects only the people who were already careful, and leaves the front door open for everyone who wasn't.
Enforcement is the part that matters. Every account, no exceptions, with the weak fallback methods (like SMS, which can be intercepted) turned off in favor of an authenticator app or a hardware key.
Do it right, not just on
A few things separate real MFA from a checkbox:
- Enforce it for administrators first and hardest. An admin account without strong MFA is the keys to everything.
- Prefer app-based or hardware tokens over text-message codes.
- Pair it with Conditional Access so logins from impossible locations or anonymized networks get blocked even if the second factor is somehow satisfied.
- Watch for MFA fatigue attacks, where an attacker spams approval prompts hoping someone taps "yes" to make it stop. Number-matching prompts shut this down.
The honest tradeoff
Yes, it adds a few seconds to signing in. That's the entire cost. Weighed against a drained operating account or a mailbox quietly forwarding your invoices to a stranger, it's not a close call.
If your team is on Microsoft 365 or Google Workspace, the capability is already in your subscription — it just needs to be configured and enforced correctly. Not sure whether yours is? That's a five-minute conversation we're happy to have.