Most small-business security incidents don't start with sophisticated hacking. They start with a password: reused, guessed, phished or leaked. Multi-factor authentication (MFA) means a stolen password alone is no longer enough to get in.
What MFA actually does
MFA asks for a second proof of identity in addition to the password — usually a code from an authenticator app, a prompt on a trusted phone, or a security key. Someone who has only your password still can't sign in.
Why small businesses are targets
Small businesses hold valuable things — customer data, payment access, email accounts that can be used to trick customers and suppliers — often with fewer protections than larger companies. Attackers use automated tools that don't care how big the business is.
Where to turn it on first
Prioritise the accounts that would do the most damage in the wrong hands.
- Email — especially the owner's and any shared inboxes. Email resets every other password.
- Domain registrar and DNS — losing these can take your website and email offline.
- Admin accounts for your website, e-commerce platform and POS.
- Banking, payments and accounting systems.
- CRM and anything holding customer information.
- Cloud storage and document sharing.
Choose the stronger methods
Text-message codes are better than nothing, but authenticator apps, device prompts and security keys are stronger because they're harder to intercept or redirect. Passkeys go further still where your systems support them.
Make it stick
- Require MFA for every admin account — not just encourage it.
- Keep recovery options current so a lost phone doesn't lock the business out.
- Review who has admin access, and remove former employees and vendors promptly.
- Include MFA setup in onboarding for every new team member.
MFA is the start, not the finish
MFA closes the most common door. A full picture also covers access reviews, backups and recovery, data protection and, increasingly, what AI tools and agents are allowed to see and do.
What a practical Security Audit reviews