How WatchGuard AuthPoint protects your business logins

Stolen passwords are now the most common entry point for every major attack type in Australia. Ransomware, business email compromise, data theft, most begin with a set of credentials someone handed over without realising it, or that were quietly lifted from a breached database. The pattern is well established, and it keeps repeating.

The ACSC’s Annual Cyber Threat Report 2024-25 found that compromised credentials were the most common way attackers gained initial access in serious incidents, featuring in 42% of cases where data was subsequently encrypted, up from 23% the year before. Identity fraud was also the leading reported cybercrime category across Australia that same year. These aren’t abstract statistics for Brisbane businesses; they describe what’s happening right now, including to businesses of 10 to 50 people who assume they’re not a target.

Multi-factor authentication (MFA) is the control that stops most of these attacks cold. If a criminal has your password but can’t pass a second check, they’re locked out. As a WatchGuard Gold PartnerTTA installs and manages WatchGuard AuthPoint for businesses across South-East Queensland, and it’s the MFA solution we recommend most often for SMEs.

What AuthPoint actually does

AuthPoint is WatchGuard’s cloud-managed identity security platform. It sits inside WatchGuard’s Unified Security Platform, which means it shares a single management console with network and endpoint security, so your IT team or managed service provider isn’t jumping between different dashboards to get a complete picture.

For each login attempt, AuthPoint verifies the user’s identity using one or more factors beyond a password. The platform supports several methods, and you can mix them to suit different users and risk levels:

• Push notifications to the AuthPoint mobile app, where the user taps approve or deny.
• Time-based one-time passcodes (TOTP) generated in the app.
• QR code verification using the phone’s camera, useful where push isn’t available.
• FIDO2 passkeys, which use device biometrics (fingerprint or face scan) and can’t be intercepted by phishing pages.
• Hardware tokens for environments where personal devices aren’t permitted.

A key feature is device DNA. Every token is tied to a specific physical device. If an attacker clones a phone to copy a token, AuthPoint detects the mismatch and blocks the attempt automatically.

Why basic push-based MFA isn’t enough on its own

Standard push notifications are a big improvement over passwords alone, but attackers have adapted. MFA fatigue, also called push-bombing, is now a recognised technique the ACSC has flagged as targeting Australian organisations. An attacker who already has your credentials simply floods a user’s phone with approval requests until someone, tired of the noise, taps approve to make it stop.

AuthPoint addresses this in two ways. First, its ThreatSync integration detects push abuse and blocks the token automatically. Second, FIDO2 passkeys remove the human decision entirely, authentication happens through a biometric tied to a legitimate device, so fake login pages and push-bombing can’t work. For higher-risk roles like administrators or finance staff, we typically recommend moving to passkeys as the primary method.

Microsoft 365 and Entra ID coverage

A common gap we see in Brisbane SMEs is MFA that covers the VPN but leaves Microsoft 365 logins protected only by a password. AuthPoint closed this gap completely in April 2026, when WatchGuard launched AuthPoint as a certified External MFA provider for Microsoft Entra ID.

This means businesses running Microsoft 365 in a cloud-only environment, no on-premises Active Directory, can now use AuthPoint to secure every Microsoft sign-in, Azure service, and any application protected by Entra ID Conditional Access. No SAML federation needed. If you’re already using AuthPoint for Windows login and VPN, your staff use the same app for Microsoft 365 as well, which cuts down on authenticator sprawl.

For organisations running Microsoft 365 across their business, this is a meaningful step forward, one MFA solution covering your whole environment from a single cloud console.

Dark Web Credential Monitoring

AuthPoint is available in two tiers. The base tier covers MFA across all your environments. The Total Identity Security tier adds Dark Web Credential Monitoring, which scans for exposed credentials before they can be used against your business.

This matters because most breached passwords circulate on dark web markets for months before anyone acts on them. Knowing that a staff member’s credentials have been exposed gives you the chance to force a reset before an attacker tries to use them. For businesses that handle sensitive client data, law firms, accounting practices, medical clinics, this proactive layer is worth considering.

Cloud management and zero-trust policies

AuthPoint runs entirely from WatchGuard Cloud. There’s no on-premises hardware to manage. For smaller businesses or those without a dedicated IT team, this keeps deployment fast and ongoing management straightforward.

Zero-trust policies let administrators evaluate every login in context, device, location, and behaviour, before granting access. A login from an unfamiliar country at 2am can be blocked automatically, even if the credentials and MFA are correct. This kind of adaptive control is now part of what the ACSC’s Essential Eight framework expects at Maturity Level 2, making AuthPoint a practical step toward meeting that baseline.

Is MFA enough on its own?

MFA is one of the highest-impact controls you can put in place. It stops the majority of credential-based attacks. But it works best as part of a layered approach, alongside email security, endpoint protection, and a solid backup strategy. Our IT security assessments look at MFA coverage alongside those other layers, so you get a clear picture of where the gaps are, not just a single control ticked off a list.

If you want to understand how your current setup compares, and whether AuthPoint is the right fit, our guide to multi-factor authentication covers the basics, or speak to us directly.

Quick check: do you need to act?

If you can answer yes to any of these, it’s worth a conversation:

• Staff log into business systems using only a username and password.
• Microsoft 365 or cloud apps are accessible without MFA.
• VPN access doesn’t require a second factor.
• You’ve had staff receive unexpected MFA push requests they didn’t initiate.
• You don’t know whether any staff credentials have appeared in a data breach.

How do we get started?

We can assess your current identity security, recommend the right AuthPoint configuration for your business, and handle deployment. Reach out to the TTA team through our contact page and we’ll take it from there.