Multi-Factor Authentication: Boosting Your Cybersecurity

Passwords are no longer enough to protect your business.

Even a strong, unique password can be stolen through phishing, malware or a data breach. Multi-factor authentication (MFA) adds another layer of security, making it much harder for someone to access an account using stolen credentials. Every business is urged to introduce MFA to its online operations. While this doesn’t make your systems impenetrable, it’s a huge step forward in protecting them.

How does MFA work?

MFA requires users to prove they are who they say they are using more than one type of authentication.

A password, PIN or security question is something you know. MFA adds something you have, such as your smartphone or authentication app, or something you are, such as your fingerprint or face. For example, you might enter your password and then be asked to approve a notification on your phone, enter a one-time code or use a fingerprint. This means that if a hacker knows or guesses your password, they still need to overcome that second layer of authentication.

In 2025, 60—62% of all breaches started with phishing or social engineering, showing why protecting the login process is so important. Microsoft reports that MFA blocks more than 99% of unauthorised access attempts. (Phishing Trends Report 2026, Microsoft Digital Defence Report 2025)

MFA doesn’t make your business technology unassailable against cyber threats, but it undoubtedly makes a very significant difference.

What are the benefits of MFA?

MFA gives you greater confidence that the person logging in is actually the authorised user. This helps your business by:

• Reducing the risk of account takeover if passwords are weak or compromised.
• Protecting valuable business data, including email, customer information and financial records.
• Strengthening remote working security by adding another check when employees access systems outside the office.
• Adapting to your company’s needs via customised MFAs and easy scalability.
• Reducing the impact of phishing and password attacks, particularly when stronger forms of MFA are used.
• Supporting compliance and good cybersecurity practice by demonstrating that access is being properly controlled.
• Working with single sign-on (SSO) solutions. This means a single login can access multiple systems or applications without the need for separate credentials for each platform.
• Using contextual data, such as location, to assess the level of risk.

MFA has its limitations

Using MFA does not mean your business cannot be hacked.

An advanced technique known as adversary-in-the-middle (AiTM) phishing can capture credentials and authentication tokens during a real-time login. Microsoft has reported campaigns capable of bypassing conventional, non-phishing-resistant MFA in this way. (Microsoft)

‘Attackers are becoming much better at targeting the authentication process itself,’ explains Eric Hughes, founder of EMH Technology in Hitchin. ‘Even if your MFA code is only valid for 30 seconds, it’s enough time for someone to log in from elsewhere using that code.

‘Identity theft is becoming more common and the attacks are increasingly sophisticated. We have found Huntress software to be extremely helpful in protecting many of our clients against phishing. Rather than simply providing security software, Huntress combines technology with a 24/7 team of security analysts who actively monitor, verify and respond to threats. This can include instantly revoking account access, for example. It’s an impressive way to proactively deal with identity threats.’

MFA is a great first step

MFA is becoming essential as part of a layered approach to cybersecurity. ‘MFA tools differ in strength. SMS and one-time codes provide useful additional security, but phishing-resistant MFA, such as passkeys or security keys, offers stronger protection against sophisticated attacks,’ says Eric.

‘MFA should therefore form part of your wider security strategy that includes secure email, device protection, patching, access controls, backups and regular staff training.’

Would you like to review how well your business is protected?

The experts at EMH Technology can assess your current setup, identify vulnerabilities and help you put stronger, practical security measures in place. Contact us for an initial discussion without obligation.