Five signs your business should enable MFA today

MFA isn't just for enterprises

If you think two-factor authentication is something only banks and government departments need, look at your email breach notifications. Microsoft 365 and Google Workspace accounts with only a password are the number-one way attackers get into small businesses.

They don't need to hack you dramatically. They need one reused password from an old website, one phishing email someone clicks, or one laptop left unlocked in a café.

Five signs you're overdue

1. Staff check email on phones — lost devices with saved passwords are a common entry point.
2. You have shared or generic accounts — info@, accounts@, workshop@ without MFA is an open door.
3. Anyone has local admin on their laptop — attackers love local admin; MFA on the identity provider limits blast radius.
4. You've never tested "what if someone gets into email" — if the answer is panic, MFA is step one.
5. A client or insurer asked about cyber controls — MFA on email is now table stakes in supplier questionnaires.

What MFA feels like day to day

Modern MFA isn't all key fobs and RSA tokens. For most SMEs it's an app on your phone — Microsoft Authenticator or Google Authenticator — approving a login, or a push notification you tap yes on.

Yes, there's a one-time grumble when it rolls out. Then people forget it exists because it takes four seconds.

Rolling it out without mutiny

We enable MFA in phases: directors and finance first, then the wider office, with a cheat sheet for "I'm on my phone and it asked me something weird." We keep a break-glass admin account secured separately and document recovery codes properly.

Need a hand enforcing MFA across Microsoft 365? Get in touch — it's usually a same-week job, not a six-month project.