If you do only one thing to improve your organisation's security this year, make it multi-factor authentication (MFA). Even when a password is stolen through phishing or a data breach, MFA stops most attackers from using it, because they also need something only the real user has, such as their phone or a security key.
Which methods to use
- Authenticator apps: a good, low-cost default for most staff.
- Security keys and passkeys: the strongest protection, ideal for administrators, finance and leadership.
- Text message codes: better than nothing, but vulnerable to SIM swapping. Use only as a fallback.
Where to start
Prioritise the systems that matter most:
- Email and collaboration tools, the gateway to almost everything else.
- Remote access, VPNs and cloud management consoles.
- Finance, banking and payroll systems.
- Your password manager.
- Customer and business applications.
A phased rollout
- Week 1: enable MFA for IT administrators and test the process.
- Week 2: roll out to leadership and finance, offering hands-on help.
- Weeks 3 and 4: roll out to all staff in groups, with a clear deadline.
- Afterwards: enforce MFA for everyone and block older sign-in methods that bypass it.
Communicate clearly
Explain why MFA matters in plain language, with a real example of an attack it would have stopped. Share short guides with screenshots, and offer drop-in sessions for anyone who needs help. Most resistance disappears once people see how quick it is in practice.
Plan for lost devices
People will lose or replace phones. Agree a secure process for resetting MFA that verifies identity properly, as attackers often target help desks with convincing requests. Provide backup codes or a second method to those who need them.
Watch out for MFA fatigue
Some attackers flood users with sign-in approval requests, hoping someone will tap "approve" just to make them stop. Use number matching or location details in approval prompts, and teach staff to report unexpected requests immediately.
Do not forget shared and service accounts
Shared mailboxes, social media accounts and older systems are often missed. Bring shared credentials into a password manager with MFA, and review accounts that cannot support MFA to see whether they can be replaced or protected another way.
Combine MFA with conditional access
Many identity platforms can apply extra checks based on risk. For example, they can require MFA every time for administrators, block sign-ins from countries where you do not operate, or only allow access to sensitive systems from company-managed devices. These conditional rules strengthen security while reducing interruptions for ordinary, low-risk sign-ins, which keeps users happy and attackers out.
Measure success
Track the percentage of accounts protected, aiming for every account. Review sign-in reports for blocked attempts; they are often a powerful reminder of why the effort was worthwhile.
Our Cybersecurity Services team can plan and run your MFA rollout, from policy to user support.
