What two-factor (MFA) is and why you should turn it on now

If you do just one thing this year for your company's security, make it this: turn on multi-factor authentication. It is the measure that stops the most attacks for the least effort, and yet a huge number of companies have it switched off. We explain what it is, why it matters so much and how to set it up.

What multi-factor authentication (MFA) is

MFA stands for multi-factor authentication, also called two-factor or 2FA. In plain terms: to get into an account, on top of the password it asks for a second proof that it is you. Usually a code from an app on your phone or a tap to confirm. Two keys instead of one.

Why a password alone is no longer enough

Passwords are stolen, leaked and guessed every day. If someone gets yours, with MFA it is useless to them: they are missing the second key, which is on your phone. That is why MFA stops the vast majority of unauthorised access, even when the password is already compromised.

How it works in practice

When you sign in to email or an application from a new device, after the password you get a prompt: enter this code or confirm on your phone. You approve it in a second; an attacker on the other side of the world cannot. On trusted devices it can be remembered for a while, so it is not a nuisance day to day.

Where you should turn it on now

• Company email (Microsoft 365, Google Workspace): it is the door to almost everything else.
• Administrator access to any system.
• Banking and financial tools.
• Remote access to your network or servers.
• Cloud applications with customer data.

Myths worth dropping

"It is a hassle for employees": after the first day, you barely notice. "My company is small and of no interest to anyone": attacks are automated and look for the unprotected, not the big. "A good password is enough": no password survives a leak; MFA does. We build it into our cybersecurity for businesses service, along with team training, because phishing is exactly what two-factor helps to stop.

Frequently asked questions

What is two-factor or MFA?

It is a system that, on top of the password, asks for a second proof of identity when you sign in, usually a code or a confirmation on your phone. That way a stolen password is not enough to get in.

Why is turning it on so important?

Because it stops the vast majority of unauthorised access even if the password has leaked. It is the security measure that protects the most for the least effort.

Is it a nuisance for employees?

Very little. Once set up, on trusted devices it is rarely asked for, and approving access takes a second.