Multi-Factor Authentication (MFA): You’ve Heard of It. Now Actually Turn It On
- Neil Hare-Brown
- Apr 23
- 3 min read
Updated: Jul 14
Let’s not pretend you haven’t heard of MFA. You have. Everyone has. It’s been mentioned in every cyber awareness session, every password reset prompt, and probably that one email from IT you definitely meant to read.
It's a fair bet that you have actually been using MFA to access your bank account for years...and yet… I'd hazard a guess it’s still not enabled across your business.
Multi-Factor Authentication (MFA) is one of the simplest, cheapest, and most effective cybersecurity tools available. It takes minutes to set up and blocks the vast majority of account compromise attempts - including phishing attacks and ransomware access.
So, in case you still need convincing (or something to forward to that one department who hasn’t turned it on yet), here’s everything you need to know - and why not using MFA is basically asking for trouble.
What Is MFA (and Why Is It So Effective)?
Multi-factor authentication (MFA) is that extra step you probably skip - but shouldn’t.
It asks you to prove who you are using more than just a password. That might be your phone, your fingerprint, a face scan, or a hardware key.
Why does it work?
Because most cyber attacks, especially ransomware, start with stolen, reused, or guessed passwords. MFA shuts that down fast.
It’s like asking someone to show ID, not just know the secret knock.
Which Type of MFA Should You Actually Bother With?
Not all MFA is created equal.
Some is solid. Some is shaky. Here’s the quick rundown - from “barely acceptable” to “rock solid”:
❌ SMS-based codes
Not ideal but better than nothing. This type of MFA is vulnerable to SIM-swapping and interception. Think of this as the wobbly table leg of cybersecurity.
✅ Authenticator apps (Microsoft Authenticator, Google Authenticator, Duo, etc.)
These generate time-based codes on your phone. They’re fast, reliable, and way better than SMS.
✅ Push notifications
Tap to approve or deny login attempts. Even better when combined with biometrics.
🛡️ Hardware security keys (YubiKey, Titan Key)
Top-tier. Physical devices that plug into your laptop or tap via NFC. Super secure, especially for high-risk users or privileged accounts.
TL;DR: Authenticator apps or hardware keys = great. SMS codes = barely acceptable. No MFA = disaster waiting to happen.
This Blog Will Take Longer to Read Than Enabling MFA
Real talk:
It’ll take you longer to finish this blog than it would to just turn MFA on. Most platforms include it, you just need to find the setting and click "enable".
Who Should Enable MFA?
Short answer? Everyone. Longer answer? Still everyone.
But especially:
Executives and directors (attackers love a high-value inbox)
Finance teams (you move money - you need MFA)
IT admins and sysops (you hold the keys to the kingdom)
Anyone with access to customer, employee, or business-critical data
Anyone who reuses the same password for everything (don’t lie, we know)
If you’re wondering whether you count - you do!
Where You Should Enable MFA
If it connects to your business or your data, it needs MFA.
That includes:
Email (Microsoft 365, Gmail, etc.)
VPN and remote access
Cloud platforms (CRM, HR, finance, project tools)
Admin dashboards
Password managers and backup systems
If your IT platform doesn't support MFA… it might be time to replace it.
Why MFA Works So Well
Attackers rely on the path of least resistance. MFA breaks that pattern.
Even if your credentials are stolen in a phishing scam or data leak, MFA blocks unauthorised access. It buys time, raises alerts, and often stops the attack before it starts.
It’s one of the few security measures that genuinely prevents account takeovers - not just detects them after the fact.
How to Roll It Out Without Drama
Make it company policy - no exceptions
Roll out in phases if needed (start with critical users)
Send clear, simple setup instructions
Use SSO to simplify logins across platforms
Chase the stragglers (they’re always out there)
Monitor adoption and follow up
Most businesses can be fully MFA-enabled in under a week. Zero excuses.
STORM Guidance Can Help You Get It Done Right
We help businesses of all sizes get the basics right - and that starts with MFA.
✔ Quick rollout strategy
✔ Platform and policy reviews
✔ Executive and staff training
✔ Advice on the best tools (apps vs hardware keys)
✔ Broader cyber hygiene and ransomware defence
There’s No Good Reason Not to Use MFA
It’s fast. It’s free. It’s easy. It works.
And yet too many breaches still happen because it wasn’t switched on.
So if you’ve made it this far, consider this your final nudge:
Just enable MFA. Right now!
