MFA, the best £0 you'll spend on security

Published 2026-06-03 by Woodruff Training

If you only do one thing after reading this, make it this: turn on multi-factor authentication. It is free on almost every business system you already use, and it stops the single most common way small businesses get breached: someone else logging in with a password that has been guessed, reused, or stolen.

What MFA actually is

MFA (sometimes called two-factor or 2FA) simply means a password is not enough on its own. After the password, the system asks for a second thing, usually a code from an app on your phone, or a tap to approve. Even if a criminal has your password, they cannot get in without that second step.

Why it matters so much

Passwords leak constantly. People reuse the same one across their email, their bank, and a dozen websites, and when any of those sites is breached, that password ends up on a list criminals buy and try everywhere. MFA breaks that chain. Microsoft and others have repeatedly found it blocks the overwhelming majority of these automated account-takeover attempts.

Where to switch it on first

Start with the accounts that would hurt most if someone else got in:

  • Email: the master key. Whoever controls your email can reset the password on everything else.
  • Online banking and accounting: the obvious target.
  • Microsoft 365 / Google Workspace: where your files and staff accounts live.
  • Your website and domain host: so nobody can hijack your address.

Do it properly

A few things make MFA far more effective:

  1. Use an authenticator app (or a hardware key) rather than SMS text codes where you can. Text messages can be intercepted.
  2. Turn it on for every staff member, not just the owner.
  3. Save the backup codes somewhere safe so nobody gets locked out.

It really is an afternoon's work for most small teams, and it is one of the highest-value hours you will spend all year. If you would rather someone rolled it out across your team properly, and showed everyone how to use it, that is exactly what our MFA rollout covers.