Multi-factor authentication (MFA) is a sign-in method that asks for a second proof after the password: an app code, a push approval or a security key. Even with a stolen password, the attacker cannot complete the second step, so account takeover risk drops sharply. When rolling out multi-factor authentication for business, start with email, remote access and admin accounts.
What is MFA, and why is a password on its own no longer enough?
Employee passwords usually leak in one of three ordinary ways: someone types theirs into a phishing page, reuses one that later appears in a breach dump from another site, or picks one that is easy to guess. In each case the attacker signs in with the correct password, so your firewall and antivirus see a perfectly normal session. However complex your password rules are, a stolen password is still a working key.
MFA makes that key useless on its own. Authentication relies on three kinds of evidence: something you know (a password or PIN), something you have (a phone, security key or smart card) and something you are (a fingerprint or face). Multi-factor authentication requires at least two of these, from different categories. Two-factor authentication (2FA) is simply the most common form of MFA, and in everyday use the terms are largely interchangeable.
The other half of the problem — length rules, reuse and shared account passwords — is covered in our guide to business password security. This article focuses on choosing the second factor and rolling it out across a company.
The cost of going without MFA: what the data shows
Identity attacks have become one of the most common ways in. According to the Microsoft Digital Defense Report 2025, more than 97% of identity attacks are password attacks, and phishing-resistant MFA can stop over 99% of them. Peer-reviewed research measuring the same effect reaches a similar conclusion:
A Microsoft study of Azure AD (Entra ID) accounts found that MFA reduces the risk of compromise by 99.22% across the whole population and by 98.56% where credentials had already leaked. (Microsoft Research, "How effective is multifactor authentication at deterring cyberattacks?", 2023)
Adoption still lags. The UK government's Cyber Security Breaches Survey 2025/2026 found that only 47% of UK businesses use two-factor authentication. In Türkiye, the Ministry of Trade's Outlook of E-Commerce in Türkiye Report 2025 surveyed 781 e-commerce businesses: strong passwords plus MFA was the most common security measure at 62%, so even the most widespread safeguard is still missing in a sizeable share of businesses.
Think of the cost through a single account. A compromised mailbox is the ideal platform for sending your suppliers fake payment instructions, as we show step by step in bank detail change email fraud. If personal data in that mailbox was accessed without authorisation, the incident may also count as a personal data breach under Türkiye's data protection law (KVKK), bringing a duty to notify the Board within 72 hours.
MFA methods compared: how secure is each one?
Not every second factor offers the same protection. Ask two questions when choosing: can an attacker capture the code or approval through a phishing page, and can your staff use the method every day without friction?
| Method | How it works | Phishing resistance | Best suited to |
|---|---|---|---|
| SMS code | A one-time code arrives by text | Low: can be typed into a fake page or hijacked through SIM swap | Transitional use when nothing else is available |
| Authenticator app (TOTP) | The app generates a code that changes every 30 seconds | Medium: the code can still be typed into a fake page | A good default for most staff accounts |
| Push approval | The phone asks "Is this you signing in?" | Medium: open to fatigue attacks; stronger with number matching | Mobile-first teams |
| Security key / passkey (FIDO2) | The device signs only for the genuine site's domain | High: does not work on a fake site | Admins, finance, IT, remote access |
| Smart card / certificate | Sign-in with a card or device certificate | High, but needs infrastructure | Corporate network, VPN, critical systems |
The key idea here is phishing-resistant MFA. Modern phishing kits take the user to a pixel-perfect copy of the real sign-in page, relay the password and the SMS or app code to the genuine site in real time, and can then steal the session cookie. FIDO2 security keys and passkeys only produce a signature for the correct domain, so this attack simply fails. We show how such pages are built in how to spot phishing emails.
Watch out for MFA fatigue as well. An attacker who already knows the password sends a stream of push requests late at night and waits for the user to tap "Approve" just to make it stop. Number matching, where the user types the number shown on screen, and location details in the prompt reduce this risk considerably. An approval request you did not expect most likely means your password has leaked; reject it and change the password straight away.
Rolling out multi-factor authentication for business: a seven-step plan
Announcing "everyone switch it on tomorrow" swamps the help desk and turns exceptions into permanent fixtures. A phased plan gets you there faster:
- Inventory your accounts. Email, cloud storage, VPN and remote desktop, ERP, accounting and banking portals, the domain and DNS panel, social media. Note whether each supports MFA and which methods it offers.
- Rank them by risk. First wave: admin accounts, email, remote access and finance. These are the doors behind which attackers find the most money and data.
- Choose methods by role. Security keys or passkeys for admins, IT and finance; an authenticator app for everyone else. Use SMS only temporarily, and only where there is no alternative.
- Write down enrolment and recovery. How does someone who loses their phone re-enrol? How does the help desk verify identity? Where are recovery codes kept? If this is not written down, attackers will phone the help desk and talk their way into an MFA reset.
- Start with a pilot. Run it with one department for two weeks, collect the issues and produce a short user guide. Then roll out in waves.
- Switch off legacy protocols. If old mail client connections and basic authentication remain open, attackers walk in through the side door without ever seeing the second factor. Modern applications connected to a central identity usually speak SAML or OIDC; our SAML vs OIDC comparison explains when to choose which.
- Monitor and close exceptions. Report regularly on accounts without MFA, rejected approval requests and sign-ins from unusual locations. Every exception needs an owner and an end date.
The natural companion to these steps is bringing identities together. Enforcing MFA once through a central identity, rather than app by app, is easier for users and administrators alike, as we explain in single sign-on (SSO) benefits. Closing a leaver's accounts belongs to the same chain; see our guide to offboarding email access.
What MFA does not protect against
MFA is a strong layer, not the only one. Session cookies stolen after sign-in, malware-infected devices and help-desk resets obtained by deception all need additional controls. Being able to list sessions by device and end them remotely, ending every session when a password changes, and keeping devices patched narrow those gaps considerably. The zero trust security model, which re-verifies every request by identity, device and context, brings these layers together. Our SME cyber security checklist walks through the remaining basics.
The same logic applies in the physical world: in critical areas such as a data centre or server room, a card alone is rarely considered enough, and a second check with a logged record is expected. We cover this in data centre access control.
How we handle MFA at Digital Bridge
We treat an MFA project not as a settings change but as a rebuild of how identity and access work in your organisation:
- Discovery and needs analysis. As part of our cyber security consultancy, we map which systems are reachable from the internet, where MFA is already on and which accounts carry admin rights. The output is a prioritised account list and a recommended method for each role.
- Cloud and remote access. For internet-facing services such as email, file sharing and VPN, we plan MFA, the retirement of legacy protocols and session policies together through our cloud migration and infrastructure consultancy.
- Pilot and rollout. We run a pilot with one department, document enrolment and recovery, and write the user guide around your own screens.
- Integration. Where in-house or legacy applications do not support MFA, our system integrations team connects them to a central identity provider; if needed, we redesign the sign-in layer as custom web software.
- Logging and compliance. We align how long sign-in logs are kept, and who can access them, with the technical and organisational measures in our data protection compliance work.
We applied the same care to identity and session management in our own Smart360 product family. Staff sign in to every product with a single identity (SmartID), sessions are listed with device details and can be ended remotely, and changing a password closes all sessions. Human verification on sign-in screens stops password-guessing attacks before they reach the server, and a leaver's access is removed from every product in a single action.
Next step
The most useful thing you can do this week is simple: list every account with admin rights and every mailbox, and note next to each whether MFA is on and which method it uses. The blank lines are your priorities. To review the list together and build a rollout plan around your systems, get in touch. For more guides, visit our Cyber Security and Data Protection hub.