MFA Everywhere: Non-Negotiable

The Single Best Security Control

If you asked a room of cybersecurity experts "What one thing should every business implement immediately?", the unanimous answer would be Multi-Factor Authentication (MFA). Not expensive firewalls. Not AI-powered threat detection. Not 24/7 security operations centres. MFA.

Microsoft's research shows that MFA blocks over 99% of automated account compromise attacks. Over ninety-nine percent. There is no other security product with that return on investment. If you do nothing else this year for security, turn on MFA for everything.

How Accounts Get Compromised

Understanding why MFA is so effective requires understanding how attacks work:

• Credential Stuffing: Attackers buy lists of leaked username/password combinations from previous data breaches and try them everywhere. If you used the same password for LinkedIn and your work email, and LinkedIn was breached, your work account is now compromised. MFA stops this dead, the attacker has your password but can't get the second factor.
• Phishing: Someone tricks you into entering your password on a fake login page. The attacker now has your credentials. With MFA, they still can't log in without your phone or authenticator app.
• Brute Force: Automated tools try thousands of password combinations. MFA makes this pointless, even a correct guess doesn't work without the second factor.

Without MFA, a single compromised password is game over. With MFA, a compromised password is just the first of several barriers.

"It's Annoying"

Yes, it takes 4 extra seconds to approve a login. We hear this complaint constantly. Here's the perspective:

• Recovering from a ransomware attack: 4 weeks average, often R500,000+ in costs
• Cleaning up after a compromised email account: days of staff time, damaged client relationships, potential POPIA reporting requirements
• Approving an MFA prompt: 4 seconds

The math isn't complicated.

Modern MFA is also less annoying than its reputation suggests. Microsoft's Authenticator app uses "number matching" to prevent approval fatigue. Instead of just clicking "Approve", you type in the 2-digit number displayed on your login screen. This prevents you from accidentally approving a hacker's login while you're distracted or half-asleep. It takes the same amount of time but dramatically improves security.

Types of MFA (In Order of Security)

1. Hardware Keys (FIDO2/Passkeys): Physical devices like YubiKey that plug into your computer. Virtually impossible to phish. Best for high-value accounts and executives.
2. Authenticator Apps: Microsoft Authenticator, Google Authenticator, Authy. Generate time-based codes or push notifications. Excellent security for everyday use.
3. SMS Codes: Better than nothing, but SIM-swapping attacks make these vulnerable. Use if nothing else is available, but upgrade when possible.

Conditional Access: Security That Adapts

Modern identity platforms (Microsoft Entra, Google Workspace) support conditional access policies that make MFA smarter:

• "If the user is in our office building, on a managed device, don't require MFA for every login. Trust the environment."
• "If the login attempt is from an unusual country, require MFA AND block access until an admin reviews."
• "If accessing sensitive SharePoint sites, always require MFA regardless of location."

This balance of security and convenience is possible with modern identity policies. Your employees get a friction-free experience during normal work, while unusual activity triggers additional verification. The technology has evolved far beyond "always ask for a code." Rolling out MFA and conditional access is a standard part of our cybersecurity service, usually done in under a week.