Multi-factor authentication (MFA)

Multi-factor authentication requires two or more separate types of proof, such as a password plus a code from a phone app, before granting access to an account.

The factors fall into three categories: something you know (a password or PIN), something you have (a phone, app or security key) and something you are (a fingerprint or face). Requiring more than one means a stolen password on its own is not enough to get in.

Stolen or guessed passwords remain one of the most common ways attackers break into small businesses, particularly through email and remote access. MFA is one of the most effective and affordable defences available, and most cyber insurers now ask whether it is enforced on email, remote access and administrator accounts before issuing a policy.

Practical tip: prefer authenticator apps or physical security keys over text message codes, which can be intercepted through SIM swapping. Teach staff to reject any sign-in prompt they did not start themselves, since attackers sometimes send repeated prompts hoping someone will approve one out of frustration.