Multi-Factor Authentication for a Small Business: Where It Belongs, Which Kind Works, and Why Outlook Alone Is Not Enough

The agency that had MFA on one door out of five

The owner of a 16-person independent insurance agency has a sticker on her monitor that says MFA ON. Her IT contractor put it there in 2024 after turning on multi-factor authentication for Outlook, and she has told two carriers and one auditor since then that "we have MFA".

She does. On email.

The agency-management system, the one that holds every client's policy, date of birth, driver's license number and premium-finance agreement, still takes a username and a password. So does the VPN the two remote account managers use from home. So does the owner's Dropbox, which is where the scanned applications live because it was easier than the document module.

On a Wednesday in March an account manager types her VPN password into a login page that arrived by text message, "to confirm your session". By Thursday morning someone nine time zones away is inside the agency-management system exporting client lists. The Outlook MFA works perfectly the whole time. It guards the wrong door.

The owner finds out when a client calls to ask why "the agency" needs him to re-enter his bank details on a new portal.

What the heck does this mean

Multi-factor authentication, MFA, means a login needs something you know (a password) plus something you have (a phone, a hardware key) or something you are (a fingerprint). A stolen password on its own is then not enough. That is the whole idea, and it is a good one.

Two things go wrong in small businesses. First, coverage: MFA gets turned on for the system that made it easy, which is email, and not for the systems that hold the money and the data. Second, kind: a six-digit code typed into a web page can be captured by a fake page that relays it to the real site in the same second. That trick is called adversary-in-the-middle, or AiTM, which is jargon for "the attacker sits between you and the real login and passes your code straight through".

Phishing-resistant MFA is the fix for the second problem. A passkey or a hardware security key is tied to the real website's address, so a fake page cannot use it. The code on your phone is tied to nothing. It will work for a criminal just as happily as it works for you.

The numbers that matter

MFA was missing where it mattered in 59% of the 661 incident response and managed detection cases Sophos analyzed in its 2026 frontline report. Not missing entirely. Missing on the one account that got used.

Adversary-in-the-middle phishing, the kind that captures a code-based login and replays it, made up 18.9% of identity attacks in the Huntress 2026 Cyber Threat Report. Nearly one in five attacks on logins is built to beat the MFA most owners think they already have.

Regulators have noticed. Universal MFA became a requirement for New York DFS covered entities under the Part 500 Second Amendment in 2025, and the HHS proposed HIPAA Security Rule update of January 2025 would make MFA mandatory with no exemption for small practices. When the regulators and the attackers agree on something, believe them.

What to do this week

1. List every system that holds money, client data or admin rights: email, the line-of-business app, VPN or remote access, cloud file storage, the bank portal, payroll, the firewall admin page. Mark which ones have MFA today. Most owners find two out of seven. (CIS 5 Account Management)
2. Turn MFA on for everything on that list, starting with remote access and admin accounts, because those are the two the attacker wants first. If a vendor's app cannot do MFA, that vendor goes on the list to replace. (CIS 6 Access Control Management)
3. Move the owner, the bookkeeper and anyone with admin rights to phishing-resistant MFA: a passkey or a hardware key such as a FIDO2 token. They cost less than lunch each and cannot be relayed by a fake page. (CIS 6 Access Control Management)
4. Ask IT to disable legacy sign-in protocols in Microsoft 365 or Google Workspace, the old IMAP and POP paths that skip MFA entirely. An attacker holding a password tries those first. (CIS 4 Secure Configuration of Enterprise Assets and Software)
5. Turn on number matching in your authenticator app so a tired employee cannot approve a push prompt they did not start. (CIS 4 Secure Configuration of Enterprise Assets and Software)
6. Pull the list of accounts that have not signed in for 60 days and disable them. An old account with no MFA is a spare key under the mat. (CIS 5 Account Management)

Where AccuSights fits

Our assessment does the inventory in step one for you, then checks each system for whether MFA is on, which kind, and who has been excused from it. The exemptions are always where the trouble is. The Cyber Hygiene Test takes three minutes and asks about the five doors above. A 15-minute call with an engineer afterwards gets you a list ordered by which door an attacker tries first.

Our assessment is mapped to your regulators, and the read-only compliance agent shows you which systems still accept a password alone and keeps that view current. We have no access and do not remediate; you or your IT partner turn the settings on, and we show you where.

Questions people ask

Is SMS MFA good enough? It is better than a password alone and worse than every other option. Text-message codes can be read by malware on the phone, captured by a fake login page, or intercepted when a criminal talks the carrier into moving your number to a new SIM. Use an authenticator app as the floor, and a passkey or hardware key for anyone with admin rights or access to money.

What is the difference between MFA and 2FA? Two-factor authentication is MFA with exactly two factors, usually a password and a phone. Multi-factor is the general term and means two or more. In practice people use the words interchangeably, and the question that matters is not how many factors you have but what kind: a code that can be phished, or a key that cannot.

Can MFA be hacked? Code-based MFA can be beaten. A fake login page relays your code in real time, or an attacker floods your phone with approval prompts until you tap one to make it stop. Stolen session cookies skip the login entirely. Phishing-resistant MFA closes the first two, and shorter session lifetimes plus endpoint protection deal with the third. MFA is a lock, not a vault.

The sticker on the monitor was telling the truth about one door. The attacker walked through the other four.