When a small business gets hacked, the story is usually boring. Someone reused a password, the password leaked in an unrelated breach, and an attacker simply logged in. No clever exploit was needed.
Multi-factor authentication (MFA) adds a second step when you sign in, such as a code from an app on your phone. A stolen password alone is no longer enough. It is the single most effective security improvement a small business can make, and it costs little or nothing.
Turn it on in this order
- Email. Whoever controls your email can reset the password on nearly everything else. Microsoft 365 and Google Workspace both include MFA.
- Banking and payroll. Use the strongest option the bank offers.
- Remote access. VPNs, remote desktop, and anything that lets someone reach your network from outside.
- Admin accounts for your website, domain registrar, and cloud services.
- Everything else that offers it: accounting software, social media, payment processors.
Which kind of second step?
- Best: a hardware security key, or a passkey stored on the phone.
- Good: an authenticator app (Microsoft Authenticator, Google Authenticator and similar).
- Better than nothing: text-message codes. They can be intercepted, but they still stop most opportunistic attacks.
Make it stick
Pick a day, tell your team why, and help each person set it up. Save the recovery codes somewhere safe, because losing the phone is the most common problem. Pair MFA with a password manager so nobody has to remember or reuse passwords.
If you use Microsoft 365, we can turn on MFA for your whole organization and walk each person through it. It usually takes an afternoon.