Multi-factor authentication (MFA) is one of the most valuable security controls a business can turn on, and it’s usually only half done. The gap is rarely the main email system. It’s the forgotten admin account, the vendor portal with your banking details, or the exception someone granted eighteen months ago for a system that no longer exists.
Where to turn it on
Go down this list and check each one. Don’t assume.
- Email. Every mailbox, including shared and service accounts where the platform allows it.
- Admin accounts. Every account with elevated rights, in every system. These are the accounts attackers want most.
- Remote access. VPNs, remote desktop gateways, and any Zero Trust or identity-aware proxy.
- Password managers. The vault that protects everything else needs its own second factor.
- Financial systems. Banking, payroll, accounts payable, and payment processors.
- Cloud apps with business data. File storage, CRM, practice management, ERP, and line-of-business software.
- Domain registrar and DNS. Easy to overlook. If someone takes over your domain, they can take over almost everything else.
- Backup consoles. If an attacker can delete your backups, a ransomware attack gets much worse.
Some methods are stronger than others
From strongest to weakest:
- Hardware security keys. They can’t be phished. Worth the cost for admin and finance accounts.
- Passkeys. Also phishing-resistant, and supported by more services every year.
- Authenticator apps with number matching. Good, and much better than a plain approve button.
- Plain push approval. Vulnerable to “MFA fatigue,” where someone taps approve just to make the prompts stop.
- Text message and voice codes. Better than nothing, but vulnerable to SIM swapping. Use them as a backup, not the main method.
Exceptions are where attackers get in
Every business collects exceptions over time: the service account that broke when MFA was turned on, the executive who found it annoying, the old app that only supports basic sign-in. Attackers look for exactly these.
- Review the exception list on a fixed schedule, not whenever someone remembers
- Write down why each exception exists and what it would take to remove it
- Turn off legacy sign-in protocols, which skip modern controls entirely
- Remove access promptly when people change roles or leave
Check it, don’t assume it
Pull a report of accounts without MFA and read through it. Most businesses that think they’re fully covered find somewhere between three and a dozen accounts that aren’t. If you’d like us to check your environment, ask for a review. For a broader read on your security, take the free IT Hygiene checklist. It takes about five minutes.