Author: Ami DePierro | Co-Founder, 2 Dog Digital
Ami DePierro is Co-Founder of 2 Dog Digital and a former U.S. Marine Intelligence Analyst who brings analytical precision to cybersecurity strategy for small and mid-sized businesses across the Raleigh/Triangle area. Digit is the voice. Ami is the author.
Table of Contents
Your Password Is Going to Get Stolen
Your password is going to get stolen.
Maybe not today. Maybe not this year. Maybe you have a 22-character masterpiece that would make your IT guy weep with pride. Good for you. An employee can still type it into a fake Microsoft login page on Tuesday afternoon and hand the whole thing to a criminal.
That is the problem multi-factor authentication is built to solve. A password should not be enough to walk into your business.
We have spent years telling people to make passwords longer and more complicated. That’s still good advice, especially when it comes with a password manager and unique passwords for every account. It does not change what happens when somebody gets the password.
The 2026 Verizon Data Breach Investigations Report found credential abuse appearing in 39% of breaches when tracked across the full attack chain. Attackers use credentials to get in, move around systems, gain privileges and maintain access.
Password reuse makes their job easier. Verizon found 4% of Active Directory accounts using passwords that had already been compromised somewhere else. Users were more than four times more likely to reuse an exposed password than to choose one that was simply weak.
That means an attacker may not need to crack anything. They find a password exposed in one breach, try it against Microsoft 365 and see whether somebody reused it.
Sometimes they just ask for it.
Phishing accounted for more than half of initial access in Cisco Talos Incident Response engagements during Q2 2026. Fake login pages are showing up behind QR codes and on legitimate cloud services. Phishing-as-a-Service has also lowered the amount of technical skill required to run a convincing campaign.
A good password matters. It should not be the only thing standing between an attacker and your company.
What Multi-Factor Authentication Actually Does
Multi-factor authentication requires another form of verification before an account lets someone in. That might be an authenticator app, biometric verification, a passkey or a physical security key.
The idea is simple. Somebody steals your password. Fine. They still need something else.
Digit’s Rule #5: Multi-factor authentication isn’t optional. Neither is locking the front door.
I mean that pretty literally. You lock your office when you leave even though locks can be picked. You do it because making someone defeat another security control is considerably better than holding the door open for them.
MFA works the same way. It does not make an account impossible to compromise. It makes a stolen password less useful.
For a small business, that’s a lot of protection from a control that is already available in most of the business platforms you’re using.
Not All MFA Is the Same
| MFA Method | What It Does | Digit's Take |
|---|---|---|
| SMS code | Sends a one-time code to a phone number | Better than password-only. Move to something stronger when you can. |
| Authenticator app with number matching | Uses a registered device and requires the user to match the login request | A practical choice for most SMB accounts today. |
| FIDO2 security key | Uses a physical cryptographic key | Strong choice for administrators and other high-value accounts. |
| Passkey | Uses cryptographic authentication tied to a device | Phishing-resistant and where authentication is heading. |
SMS deserves some context because I don’t want anyone reading this, turning off text-message MFA and congratulating themselves for improving security.
Don’t do that.
SMS is weaker than the other choices. SIM-swapping attacks exist, and codes can be captured by real-time phishing attacks. If SMS is the only MFA you have available, keep using it until you replace it with something stronger.
Authenticator apps with number matching are a practical next step for many small businesses. Instead of blindly tapping Approve, the employee has to match the authentication request to the login happening on the screen.
Passkeys and FIDO2 security keys go further because they’re cryptographically tied to the legitimate service. There isn’t a six-digit code for an employee to accidentally hand to the wrong website.
You don’t have to replace every authentication method in the company tomorrow. Start with administrators, executives and accounts with access to particularly valuable systems. Then keep moving.
Microsoft 365 MFA Needs More Than a Checkbox
If your business runs Microsoft 365, MFA should already be part of the conversation.
Microsoft provides Security Defaults as a baseline for smaller organizations. Businesses that need more granular control can use Conditional Access in Microsoft Entra ID to apply policies based on things such as authentication method, application, device compliance and sign-in conditions.
The important word there is configured.
“We use Microsoft 365” does not mean your authentication settings are correct. “We turned on MFA a couple of years ago” doesn’t tell me much either.
Older authentication methods deserve particular attention. If an old application or protocol can authenticate without going through the protections you’ve carefully put in place, you haven’t solved the problem. You’ve installed a very nice lock and left a side door open.
Digit’s Rule #1 applies here too: If nobody can explain how it was set up, nobody gets to call it secure.
That rule has saved me a lot of adjectives.
Attackers Learned How to Work Around MFA
MFA works, so attackers adjusted.
One method is MFA fatigue, or prompt bombing. An attacker who already has the password repeatedly triggers authentication requests. The employee gets another notification. Then another. Eventually somebody approves one because they’re confused, irritated or convinced their phone wouldn’t be asking unless they were supposed to approve it.
Number matching helps stop that. If your business still uses push notifications, verify that it’s enabled.
The more serious issue is that attackers can also target what happens after authentication.
Cisco Talos Incident Response reported authentication abuse in 65% of its Q2 2026 engagements. Their investigations included adversary-in-the-middle attacks that intercepted session tokens, OAuth device-code phishing and attacker-controlled MFA enrollment.
A session token matters because it tells the service that authentication already happened. Steal the right token and the attacker may not need to ask for the password and MFA again.
That doesn’t make MFA useless. It means MFA is a security layer, not holy water.
Phishing-resistant authentication makes credential theft harder. Conditional Access can place additional requirements on sign-ins and devices. Monitoring can catch behavior that doesn’t fit the account’s normal pattern.
You use the layers together.
Where Small Businesses Should Start
Don’t turn this into a six-month MFA committee. Start with the accounts that can hurt you most.
- Require MFA on company email and Microsoft 365 accounts.
- Require it on administrative and financial accounts.
- Replace SMS-only authentication where stronger options are available.
- Use number matching with push-based authentication.
- Evaluate passkeys or FIDO2 keys for executives and administrators.
- Review legacy authentication and old exceptions.
- Make MFA enrollment part of employee onboarding.
- Review your configuration periodically instead of assuming the setup from three years ago is still the right setup.
If you only accomplish the first two this week, you are already harder to compromise than you were last week. Then keep going.
Don't Forget MFA When Someone Leaves
Employee offboarding is where otherwise decent security processes develop strange holes.
An employee may have an authenticator registered on a personal phone. They may also have active authenticated sessions on a laptop, tablet or browser. Taking back the company computer doesn’t address either one.
Offboarding should disable the account and revoke active sessions. Registered authentication methods and devices need to be removed, and recent sign-in activity should be reviewed when appropriate.
Do it the same day.
An ex-employee’s access does not disappear because everybody agreed the employment relationship was over.
Digit’s Rule #12: An ex-employee’s login works until someone makes it stop working.
Computers are annoyingly literal about these things.
The Bottom Line
Multi-factor authentication for small business is no longer an advanced security feature. It’s one of the basic controls that should be in place anywhere an account can reach company email, data or critical systems.
Start with MFA everywhere it matters. Get away from SMS-only authentication when stronger methods are available. Make sure Microsoft 365 is actually configured rather than assuming the default settings are good enough. Then start moving higher-risk accounts toward phishing-resistant authentication.
- A strong password is still one password. Build another layer behind it.
- Having MFA and having good MFA are different things. Know which method you’re using.
- Start with the accounts that carry the most risk. Email, administrators and financial systems belong near the top.
- Review the setup. Security controls have a funny habit of becoming permanent after somebody calls them temporary.
If you want a second set of eyes on your MFA setup, that’s what we do. 2 Dog Digital works with small businesses throughout Raleigh, the Triangle and North Carolina to review Microsoft 365 security and find the gaps that accumulate over time.
We offer a no-charge cybersecurity assessment. You will learn something either way.
2 Dog Digital | Raleigh, North Carolina | 2dogdigital.com
FAQ
Does my small business really need multi-factor authentication?
Yes. Multi-factor authentication for small business prevents a stolen password from automatically becoming account access. Email, cloud storage, financial systems and administrative accounts are particularly important. MFA doesn't stop every attack, but password-only authentication leaves one of the most commonly abused doors protected by a single credential.
What is the best MFA method for a small business?
An authenticator app with number matching is a practical option for many small businesses. Passkeys and FIDO2 security keys provide stronger, phishing-resistant authentication and make sense for higher-risk accounts. SMS codes are weaker but still preferable to using only a password while you transition to a stronger method.
How do I set up MFA for Microsoft 365?
Microsoft 365 organizations can use Security Defaults for baseline protection or Conditional Access in Microsoft Entra ID for more granular policies. The right configuration depends on licensing, devices and business requirements. Legacy authentication methods and existing exceptions should also be reviewed so they don't create paths around MFA.
Can hackers get around MFA?
Yes, depending on the authentication method and attack. Attackers use prompt bombing, adversary-in-the-middle phishing, session-token theft and malicious authorization flows. Phishing-resistant methods such as passkeys and FIDO2 keys provide stronger protection. MFA should work alongside access policies, endpoint security and monitoring rather than being treated as the entire security program.
Where can I get help with MFA for my business in Raleigh?
A managed IT provider with Microsoft 365 and Entra ID experience can review the existing configuration before changing anything. 2 Dog Digital works with small businesses in Raleigh and throughout the Triangle to review MFA, Conditional Access, authentication methods and other Microsoft 365 security settings.