The cheap MFA you can deploy this afternoon (and why you should).

The unsexy truth about small business breaches

Almost every small business breach we've cleaned up in the last three years started the same way: a stolen password. Not a zero-day. Not a sophisticated nation-state attack. A password that was reused, phished, or guessed — used to log into M365 or Google Workspace from a residential IP somewhere overseas, at 3am.

If you do nothing else for security this quarter, turn on multi-factor authentication everywhere. It's the single biggest security upgrade you can make, and Microsoft's own data shows it stops over 99% of automated account takeover attempts.

What "MFA" actually is

Multi-factor auth means you need two things to log in: something you know (your password) and something you have (your phone, a hardware key, etc.). Even if an attacker buys your password on a dark-web forum, they can't get in without the second factor.

Three flavors, ranked

1. Hardware keys (YubiKey, Titan): the gold standard. Phish-resistant. ~$50/key. Recommended for admins.
2. Authenticator apps (Microsoft, Google, Duo): free, push-notification based. The default for the rest of your team.
3. SMS codes: better than nothing, but vulnerable to SIM-swap attacks. Don't make it the only option.

The four-hour rollout

Hour 1 — Communicate

Send a one-paragraph email to your team. Tell them: tomorrow at 9am, you'll be turning on a new sign-in step. They'll need to install Microsoft Authenticator (or Google Authenticator) on their phone. Link to a 90-second screen-recorded walkthrough. That's it.

Hour 2 — Configure the policy

In Microsoft Entra ID (formerly Azure AD), open Security → Conditional Access and create a policy that requires MFA for all users on all cloud apps. In Google Workspace, the equivalent lives under Security → 2-step verification. Enforce, don't just enable.

Policy: Require MFA — All Users
Users: All users (excl. break-glass admin)
Cloud apps: All cloud apps
Conditions: Any location
Grant: Require MFA
State: On

Hour 3 — Disable legacy authentication

This is the step most people skip, and it's the one that makes the policy actually stick. Legacy protocols like POP3, IMAP and SMTP basic auth bypass MFA entirely. Block them at the tenant level.

If you turn on MFA but leave legacy auth enabled, you've installed a deadbolt and left the back door wide open. We've seen this exact mistake on more than half the audits we run.

Hour 4 — Roll out and watch

Flip the policy to On. Watch the sign-in logs for the next 48 hours. You'll catch a few users who use a personal Outlook client at home, an old phone that won't enroll, or a service account no one remembered. Help them, document them, move on.

What it costs

For a 25-person company on Microsoft 365 Business Premium: $0 of net-new spend. MFA is included. Same on Google Workspace Business Plus. The only real cost is 30 minutes of training time per employee, and an afternoon of an engineer's time to configure.

The harder questions, briefly

What about MFA fatigue attacks? Real risk if you let users approve push prompts blindly. Turn on number-matching in Microsoft Authenticator — it forces users to type a number they see on screen, which kills the attack.

What about VPN access? Your VPN should also require MFA. Most modern VPNs and zero-trust tools (Cisco Duo, Cloudflare Access, Tailscale) integrate with your identity provider in 15 minutes.

What about admin accounts? Hardware keys, full stop. The cost of a compromised global admin is catastrophic. Spend the $100 per admin and sleep better.

Don't wait for the breach

We get the call about once a month. "Someone got into our email and started sending wire transfer requests to our clients." The cleanup takes weeks. The reputational damage takes longer. The fix — half a day of MFA work — would have stopped it.

If you'd like help rolling this out across your team, that's exactly the kind of project we knock out as a fixed-fee engagement. Talk to us.