Two-factor authentication —MFA, or 2FA— is the security measure with the best cost-to-effect ratio a small company can deploy. It is also one of the most commonly half-implemented, creating a false sense of protection that does not exist.
This guide explains what it genuinely stops, what it does not stop at all, and how to roll it out in an SME without blocking the team on the first Monday.
What two-factor is (and is not)
Two-factor means that getting in requires two things of a different nature: something you know (the password) and something you have (the phone, a physical key) or something you are (fingerprint, face).
What is not two-factor:
- Two passwords, or a password plus a secret question. Both are «something you know».
- A code sent over the same channel you are already using insecurely.
- A permanent «remember this device» on a shared computer.
The difference matters: if an attacker gets your password from a breach, a second factor of a different nature keeps them out. If the second factor is another password, it has achieved nothing.
The three factors, ranked by strength
- Physical key (FIDO2 / passkey). The strongest standard: resistant to phishing by design, because the key verifies the real domain. This is what management, administrators and banking should use.
- Authenticator app with a time-based code (TOTP). A good balance for everyone else: free, no dependency on mobile coverage and no per-user cost.
- SMS or phone call. Better than nothing, but the weakest link: the number can be ported or intercepted, and SIM swapping has been documented for years.
One detail that often goes unnoticed: email as a second factor (receiving the code in the same mailbox) is close to useless. If your email is compromised, they have the second factor too.
Why SMS is still the weak link
It is not that SMS is broken; it is that it depends on a carrier and on a number that can be moved to another SIM using leaked data. On top of that, the code lands on a device that is often synced to the computer, so the channel separation disappears.
If SMS is all you can afford for some group, use it, but do not make it the standard for administrators. And do not use it as an excuse to deploy nothing.
Push fatigue: when the attacker asks your permission
With push notification authentication, an attacker who already has your password can fire dozens of requests until one is accepted out of tiredness or by mistake. It is called MFA fatigue or push bombing.
- Enable number matching in push notifications: it tells you which number you are approving.
- Rate-limit attempts and apply temporary lockout.
- Train the team: a notification you did not request is an intrusion attempt, not an app glitch. And it gets reported.
How to roll it out in an SME, in order
- Start with what is visible from the internet. Email, VPN, remote desktop, admin panels and banking. That is where the immediate return is.
- Then administrators and management. They hold the most powerful accounts and are the main target of CEO fraud.
- Then the rest of the team. With a three-step guide and a Q&A session; much of the resistance is unfamiliarity, not unwillingness.
- Leave a recovery procedure in place. What happens if someone loses their phone on a Saturday. Without this, the team will look for shortcuts that defeat the control.
- Review service accounts. Systems that connect on their own cannot ask for a code: use managed credentials, not a shared personal account exempted from MFA.
What MFA does not fix
Two-factor does not fix a reused password, an infected machine, or an employee approving a notification they did not request. It does not protect against an attacker who is already inside the network either.
It is a layer, not a shield. For the rest of the picture, the Snowflake case shows what happens when credentials leak and nobody rotates them, and the phishing guide covers the vector that still works with MFA enabled.
Mistakes we see often
- Exempting management «for convenience». That is precisely the account most often impersonated.
- Enabling MFA only on webmail and leaving the legacy mail protocol open without two-factor.
- No documented onboarding and offboarding. An employee who leaves with the second factor still active is a door left open.
- Confusing having MFA with being protected and easing off on every other control.
Your next step
If you do not know which of your company's services are exposed today, start there: our free OSINT audit reviews your public exposure —including visible emails and access points— and delivers a report within 72 hours, without touching your systems.
And if what you want is to test what your network genuinely resists with the current defences, we do that with penetration testing authorised in writing.