If you only ever implement one security control, make it multi-factor authentication. Stolen passwords are still the most common way attackers get into a business, and MFA stops the overwhelming majority of those attempts dead. It is cheap, it is usually already included in what you’re paying for, and it can be switched on this week.
But “we have MFA” has quietly become one of the most misleading statements in business IT. The attacks have moved on, and not all second factors are equal any more. Here’s what actually holds up in 2026.
Why a password on its own is finished
Attackers rarely break in these days — they log in. Credentials leak through breaches at unrelated services, get harvested by phishing pages, or are simply guessed because the same password protects the mailbox and the loyalty card. Once someone has a working username and password, nothing distinguishes them from your staff member. MFA adds a second thing they must have, not just something they must know, and that single change removes most opportunistic attacks from the table.
The methods, from weakest to strongest
SMS one-time PINs. Better than nothing, and it is still what most South African banking and business systems default to. But SIM swap fraud is a well-established local industry, and an OTP can also be relayed in real time by a fake login page. Treat SMS as a fallback, not your standard.
Authenticator app codes (TOTP). The six-digit rolling codes from Microsoft Authenticator, Google Authenticator or similar. A significant step up — immune to SIM swaps and free to deploy — but the code can still be typed into a convincing fake site and used by the attacker within its short window.
Push approvals with number matching. Convenient, and the number-matching version (where you type a number shown on screen into the app) defeats “MFA fatigue” attacks, where an attacker spams approval prompts at 2am hoping someone taps Approve to make it stop. Make sure number matching is enabled — plain approve/deny prompts are the weak version.
Passkeys and hardware security keys. The only category regulators and standards bodies now class as genuinely phishing-resistant. These use a cryptographic key tied to the real website’s address, so a fake login page simply cannot produce a valid response. This includes Windows Hello for Business, Face ID or fingerprint passkeys on a phone, and physical keys like a YubiKey.
The attack that beats ordinary MFA
Adversary-in-the-middle phishing is the reason this article isn’t just “switch on MFA and relax”. The attacker sends a convincing link, but the fake page is a live proxy sitting in front of the genuine service. You enter your password, you get a real MFA prompt because the real service was genuinely asked, you approve it — and the attacker quietly captures the session cookie your browser is issued afterwards. They are now logged in as you, and your MFA prompt never fires again.
Ready-made kits for this are sold as a service to criminals with no technical skill. Codes and push approvals can both be relayed this way. Passkeys cannot, because the signature is bound to the real domain and the proxy is the wrong domain.
What to do about it, practically
- Cover every account, not just email. Microsoft 365 and Google Workspace are the obvious ones, but the gaps are usually elsewhere: VPN and remote access, the accounting package, the CRM, the hosting control panel, the domain registrar, and the router or firewall admin login.
- Start with privileged accounts. Global admins, finance staff, directors and anyone who can change banking details or approve payments. If budget only stretches to a handful of hardware keys, this is where they go.
- Enforce it, don’t offer it. Optional MFA gets adopted by the people who least needed it. Use Conditional Access or the equivalent policy to require it, and set a deadline for registration.
- Close the legacy back doors. Older mail protocols like IMAP and POP can bypass modern authentication entirely. Disabling legacy authentication is often the single highest-value change alongside MFA itself.
- Deal with shared and service accounts. The reception mailbox everyone uses, the scanner account, the third-party integration. These are where MFA exceptions accumulate and where attackers look first.
- Fix account recovery before it’s exploited. An attacker who can talk your helpdesk into resetting MFA doesn’t need to break it. Require identity verification — a video call, a manager’s confirmation — before anyone resets a factor, and never fall back to security questions.
- Watch for what MFA doesn’t cover. Stolen session cookies bypass login entirely. Alerts on impossible-travel sign-ins, new inbox forwarding rules and unusual mailbox rules catch what authentication misses.
The objections you will hear
“It slows everyone down.” In practice most staff authenticate once per device and are prompted again only occasionally, or when something looks unusual. Passkeys and Windows Hello are typically faster than typing a password, not slower.
“What if someone loses their phone?” Register two methods per person up front. It takes two minutes during onboarding and prevents almost every lockout call.
“We’re too small to be a target.” Credential attacks are automated and indiscriminate. Nobody is checking your headcount before trying the password that leaked from an unrelated website three years ago.
How this connects to the rest of your obligations
A compromised mailbox is not just an inconvenience — if it held personal information about clients, staff or learners, you are looking at a reportable security compromise under POPIA and the notification duties that come with it. MFA is one of the cheapest ways to keep an incident from ever reaching that point, and one of the easiest controls to point at when demonstrating that you took reasonable security measures.
It also pairs directly with the human side of the problem: MFA blunts the damage when someone falls for a phishing email, and training people to spot modern phishing reduces how often that happens in the first place. Neither replaces the other.
We roll out and enforce MFA across Microsoft 365, Google Workspace, firewalls and remote access for businesses and schools across South Africa — including the awkward parts like legacy authentication, shared mailboxes and recovery processes. If you’re not certain which of your accounts are actually covered, ask us for an audit.