Multi-factor authentication: the one login step that blocks most account takeovers

A password is one leaked spreadsheet away from being useless. Credential dumps from other companies' breaches change hands constantly, and whoever's running them doesn't care whose password it is, only that a fraction of them still work somewhere else. Multi-factor authentication is the cheapest control that actually breaks that bet. It doesn't stop a password leaking. It stops the leaked password being enough on its own.

According to the government's own survey, most UK businesses still haven't switched it on.

What MFA actually is

Multi-factor authentication, two-factor authentication, 2FA, 2-step verification, 2SV: these are all names for the same idea, and NCSC treats them as interchangeable in its own guidance. You prove who you are with something you know, your password, and then a second thing that only you should have access to. That could be a six-digit code from an authenticator app, an approval tap on your phone, a physical security key, or a fingerprint.

NCSC is explicit that security questions don't count. The answers are often guessable or publicly findable, and a mother's maiden name hasn't been much of a secret since social media existed.

Backup codes matter more than people expect. NCSC recommends keeping a set stored somewhere safe specifically for the day someone loses their phone, because the whole system falls over if the only second factor is a device that's just been left on a train.

The gap

The Cyber Security Breaches Survey for 2025/2026, the government's own annual research, found that 47% of UK businesses have any form of two-factor authentication switched on across their networks and applications. Fewer than half. Micro businesses sat at 43%, up from 35% the year before, so the trend is moving in the right direction, just slowly. Large businesses, by contrast, were at 90%.

The gap between a five-person office and a five-hundred-person one isn't the threat each one faces. It's usually just who's had time to turn the setting on.

The same survey found 43% of UK businesses, roughly 612,000 of them, reported some kind of breach or attack in the past year. Less than half protected, more than four in ten attacked: those two numbers sitting next to each other aren't a coincidence so much as a description of the same problem from two angles.

What it actually stops

Microsoft has been saying the same thing since 2019, based on telemetry from its own cloud services: MFA blocks over 99.9% of account compromise attacks. Worth saying plainly rather than pretending otherwise: it's Microsoft's own figure, not an independently audited one, and nobody outside Microsoft can check the underlying data. But no competing figure of similar scale has surfaced anywhere to contradict it, and the mechanism behind the claim is straightforward enough to believe. Automated credential-stuffing and password-spray attacks work by trying stolen or guessed passwords at scale, and almost none of that automation has any way of also producing a live approval tap on somebody's phone.

A stolen password with MFA switched on is a dead end for that kind of attack. Without it, it's a working login.

Not all MFA is created equal

NCSC updated its own MFA guidance to make an uncomfortable point: attackers have adapted. The same social engineering that tricks someone into handing over a password has been retooled to get past weaker forms of MFA too, and NCSC's own account is that attacks against MFA-protected accounts have been increasing for a couple of years now, not staying flat. Its near-term recommendation is phishing-resistant MFA by default wherever a service offers it.

The case study the whole industry now points to is Uber's 2022 breach, where an attacker with a stolen contractor password simply sent MFA approval requests over and over until the contractor, tired and assuming it was a glitch, tapped accept. That's push bombing, sometimes called MFA fatigue, and it works precisely because a plain approve-or-deny prompt gives someone no context about what they're actually approving. Number matching, where the app makes you type a code shown on the login screen rather than just tapping yes, closes that specific hole, and most major platforms support it now.

None of that is an argument against turning MFA on. NCSC's own advice on the basic version is blunt: any 2-step verification is better than not having it at all. SMS codes aren't the strongest option, mainly because they depend on signal and can be intercepted through SIM-swapping, but a business running SMS-based MFA is in a completely different position to one running none.

Where Cyber Essentials fits

If Cyber Essentials certification is on your radar, this stopped being optional in 2026. The scheme's Danzell question set, published by IASME in February and live for assessments from 26 April 2026, made multi-factor authentication a mandatory pass on every cloud service in scope where the option exists, for every user, not just admin accounts. A cloud service with MFA available and switched off is now an automatic fail, whatever else the assessment finds.

We don't hold Cyber Essentials ourselves, so we're not the ones marking anyone's paper here. But the requirement is public, and it's worth knowing about before you book an assessment, not after.

Rolling it out without a staff revolt

The usual objection isn't security. It's friction. Someone doesn't want to fumble for their phone every time they open email on a Monday morning.

A few things genuinely help. Most services let you mark a specific device as trusted for 30 days, so the prompt only reappears occasionally rather than on every login. Rolling it out to admin and finance accounts first, then the rest of the team a week or two later, gives IT time to deal with the two or three people who lock themselves out, rather than fielding forty tickets on the same Tuesday morning. And print the backup codes. Actually print them, not save them to a file on the same laptop the codes exist to protect if that laptop gets stolen.

Expect one or two people to need help re-registering a phone within the first month. That's normal, not a sign it's gone wrong.

Where to start if you can't do everything at once

Email first, always, because it's usually the account a password reset for everything else gets sent through. Then whatever holds admin rights over your Microsoft 365 or Google Workspace tenant, since that account can reach every mailbox and file in the business, not just its own. VPN and remote desktop access come next, then anything holding customer or financial data. Everything else can follow at a sensible pace rather than all at once.

Where Alpha IT fits in

Turning MFA on is usually a configuration job, not a new subscription, and it doesn't need ripping anything out first. We set it up as standard when we onboard a new managed IT client, and it's one of the first things we check during a free IT health check, alongside what's actually watching your endpoints and whether your passwords are being reused across accounts in the first place. If you're not sure what's already switched on across your business, get in touch and we'll check.