If there’s one control that consistently delivers the biggest security improvement for the smallest amount of user friction, it’s multi-factor authentication (MFA). Major identity providers, including Microsoft, have publicly stated that MFA blocks the overwhelming majority of automated account compromise attempts. And yet, in our assessments across Southern California businesses, we still regularly find critical accounts — email, banking portals, remote access — protected by password alone.
What MFA actually protects against
Passwords get reused, phished, and leaked in third-party data breaches that have nothing to do with your business. Once a password is out in the wild, it will eventually be tried against your login pages by automated bots — a technique called credential stuffing. MFA means a leaked password by itself isn’t enough to get in, because the attacker also needs your phone, security key, or authenticator app.
Not all MFA is created equal
Basic "approve this login?" push notifications are far better than nothing, but they’ve created a new attack pattern: MFA fatigue, sometimes called push bombing. An attacker who already has a valid password sends repeated push prompts until a tired or distracted user taps "approve" just to make the notifications stop.
- Number-matching MFA requires the user to type a specific number shown on the login screen into their authenticator app, which defeats blind approval.
- Conditional Access can block or challenge logins from unexpected countries, unmanaged devices, or impossible-travel patterns before MFA even comes into play.
- Passwordless and passkey options remove the password from the equation entirely, closing off credential stuffing as an attack path.
Where businesses most often skip MFA — and shouldn’t
Email and Microsoft 365 logins are the obvious first stop, but we also see gaps in: VPN and remote desktop access, admin portals for line-of-business applications, banking and payroll platforms, and shared or service accounts that never get individually reviewed. Every one of those is a realistic path to a costly incident if left with password-only protection.
Getting it right without frustrating your team
The goal isn’t to bury employees in prompts — it’s to apply the right level of friction in the right places. A well-tuned identity and access setup uses Conditional Access to stay invisible on trusted, managed devices in expected locations, and steps up verification only when something looks unusual. That balance is exactly what our Identity & Access engagements are built around.
If you’re not sure which of your business accounts still rely on a password alone, that’s a quick and worthwhile audit — reach out and we’ll help you find out.
