Why you can’t rely on passwords alone to protect your business

A Brisbane accounting firm we work with had a solid password policy in place. Every 90 days, staff changed their passwords. The passwords were long and unique. None of that stopped an attacker from walking into their Microsoft 365 environment through a stolen session cookie, bypassing authentication entirely. The breach lasted several hours before anyone noticed.

Passwords on their own have always been a weak control. What’s changed is that even adding a basic second factor is no longer the complete answer it used to be. If your business relies on a username and password alone, you’re leaving a wide-open door. If you have Multi-Factor Authentication (MFA) set up but haven’t reviewed it recently, it’s worth understanding what MFA can and can’t do in 2026. Our IT security assessments regularly surface gaps that businesses didn’t know existed.

What MFA is and how it works

Multi-Factor Authentication (MFA) means a user must prove their identity using at least two separate methods before gaining access to a system. A password alone is one factor. MFA adds a second, independent check on top of that.

The three types of factor are:

• Something you know – a password or PIN.
• Something you have – a code from an authenticator app, a hardware security key, or a one-time SMS code.
• Something you are – a fingerprint, face scan, or other biometric.

The logic is straightforward. Even if an attacker steals your password, they still need the second factor to get in. MFA can be applied to cloud applications, email, VPN access, remote desktops, and most modern business tools. Switching it on for services like Microsoft 365 takes minutes, and the ACSC’s Essential Eight framework includes MFA as one of the eight baseline controls every Australian organisation should have.

The numbers behind why MFA matters

The case for MFA is not subtle. Microsoft’s Entra ID blocks around 7,000 password attacks per second, and 97% of those identity attacks use password spray, where attackers test common passwords across thousands of accounts in parallel. MFA breaks that approach: even a correct guess doesn’t get an attacker in without the second factor.

Stolen or compromised credentials remain the leading cause of breaches. The Verizon 2025 Data Breach Investigations Report found that 22% of all breaches that year began with stolen credentials. The IBM 2025 Cost of a Data Breach Report put the average cost of a credential-based breach at around $4.67 million USD, with an average of 246 days to identify and contain it. That’s more than eight months of an attacker operating inside a business environment.

Despite these figures, adoption among smaller businesses remains low. Research from KnowBe4 found that 62% of small to mid-sized organisations don’t use MFA at all, compared with 38% of large organisations. For Queensland SMEs, that gap carries real risk. We see it regularly when clients come to us after an incident that MFA would have stopped.

What MFA doesn’t stop, and why that matters now

MFA remains one of the most effective security controls available. But the threat landscape has shifted in a way that businesses need to understand.

Attackers have developed a technique called Adversary-in-the-Middle (AiTM) phishing. Instead of stealing your password and then guessing your MFA code, AiTM attacks sit a proxy server between your browser and the real login page. You type your credentials and approve the MFA push notification normally. The attacker captures your authenticated session in real time and replays it from their device. You never know anything went wrong.

This isn’t a niche attack. Microsoft documented the Tycoon2FA phishing-as-a-service platform, which reached over 500,000 organisations globally before it was disrupted in early 2026. The CyberCX 2025 Threat Report found that 75% of Business Email Compromise (BEC) incidents in Australia involved session hijacking, up from 38.5% the year before. Standard push-notification and SMS-based MFA methods don’t stop this.

The defence is phishing-resistant MFA. That means methods that use cryptographic keys bound to a specific domain, so a fake login page or a proxy can’t capture and replay them. The main options are passkeys (FIDO2), hardware security keys like a YubiKey, and Windows Hello for Business. Microsoft now recommends phishing-resistant MFA for all administrator accounts, and Microsoft Learn has detailed guidance on setting this up in Entra ID.

What the ACSC says Australian businesses should do

The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) published updated guidance in July 2025, developed with the Council of Small Business Organisations Australia. MFA is a core recommendation in that guidance, alongside password managers, antivirus, and regular backups.

Under the Essential Eight framework, MFA requirements are structured around maturity levels. At Maturity Level 1, organisations need MFA on all internet-facing services. At Maturity Level 2, MFA must cover all privileged account access regardless of whether the service is internet-facing. The updated framework also includes specific guidance on phishing-resistant authentication methods, reflecting how the threat has evolved.

SMS-based one-time passwords are still better than nothing, but the ACSC treats them as the weakest MFA method. App-based authenticators are a step up. Phishing-resistant methods, passkeys and hardware keys, are the current best practice for any account that holds sensitive data or has elevated permissions.

For businesses that hold data on Australian residents, the OAIC’s Notifiable Data Breaches scheme also comes into play. A credential-based breach that exposes personal information may trigger a mandatory notification obligation. Getting MFA right reduces the chance of reaching that point.

What we see in Brisbane SMEs

Across the businesses we support in South-East Queensland, the most common MFA gap isn’t a refusal to use it. It’s incomplete coverage. A business will have MFA switched on for Microsoft 365 but not for their accounting software, their cloud backup portal, or their remote access tool. Attackers find the path of least resistance.

The second most common gap is SMS-based MFA on accounts that hold sensitive client data or financial access. SMS codes can be intercepted through SIM-swapping and are not accepted as sufficient at higher Essential Eight maturity levels. Switching to an authenticator app is low-cost and takes less than ten minutes per user.

The third gap is admin accounts. Privileged accounts are the highest-value targets. We’ve seen businesses with MFA on all standard user accounts but none on the admin account used for IT management. That’s the account an attacker wants most. Phishing-resistant MFA, starting with those accounts, is the right first step. A technology audit is often the fastest way to map where MFA coverage is missing.

MFA and cyber insurance in 2026

Cyber insurance underwriters have moved MFA from a recommended control to a hard prerequisite. Businesses without MFA on email, remote access, and privileged accounts are now commonly declined at first submission. Some insurers require phishing-resistant MFA on administrator accounts as a condition of coverage. If your renewal is coming up and you haven’t reviewed your MFA configuration, it’s worth doing that before the insurer does. Our cyber insurance compliance support covers exactly this kind of pre-renewal review.

A practical starting point

MFA doesn’t have to be complicated. Here’s a sensible order of operations for an SME:

1. Turn on MFA for all Microsoft 365 accounts if it isn’t already on. Use the Microsoft Authenticator app rather than SMS where possible.
2. Cover every internet-facing service – email, VPN, remote desktop, cloud storage, accounting software, and any portal with client data.
3. Move admin accounts to phishing-resistant MFA first – passkeys or hardware security keys for anyone with elevated access.
4. Remove SMS as a fallback for sensitive accounts – SMS is a weak link, and attackers know it.
5. Pair MFA with a password manager so staff aren’t reusing passwords across systems. Our Keeper Password Manager deployment makes this straightforward for teams of any size.

Strong password practices and MFA together close the majority of credential-based attack paths. Neither alone is enough.

Common questions about MFA for business

Is MFA enough to protect my business accounts?

MFA is one of the most effective controls available and should be enabled on every account. On its own, though, it’s not complete protection. Modern AiTM phishing attacks can bypass standard MFA methods by stealing authenticated sessions. Phishing-resistant MFA (passkeys or hardware keys) and Conditional Access policies add the layers that close this gap.

What’s the difference between SMS MFA and an authenticator app?

SMS one-time codes are the weakest form of MFA. They can be intercepted through SIM-swapping, and Australian carriers have varying levels of protection against this. Authenticator apps generate codes locally on the device and are harder to intercept. For sensitive accounts, app-based MFA is the minimum. Passkeys or hardware keys are better again.

Do I need MFA if my team uses strong passwords?

Yes. Stolen credentials are the leading cause of breaches, and passwords are stolen through phishing, data breaches at other services, and malware, not just guessing. Strong passwords slow attackers down; MFA stops them even when the password is already known. The two controls work together, not instead of each other.

How does MFA fit into the ACSC Essential Eight?

MFA is one of the eight controls in the ACSC’s Essential Eight framework. At Maturity Level 1, it’s required on all internet-facing services. At Level 2, it extends to all privileged access. The 2025-2026 updates to the framework include specific guidance on phishing-resistant methods. Most Australian SMEs should be targeting Maturity Level 2 as their baseline.

What accounts should I prioritise for MFA first?

Start with administrator and privileged accounts, then email, then any system containing client or financial data. These are the accounts attackers target most and where a compromise causes the most damage. Once those are covered with the strongest MFA method available, extend coverage to every other business system.

Where do I get help setting up MFA for my business?

TTA can audit your current authentication setup, identify gaps in MFA coverage, and configure the right solution for your environment, whether that’s Microsoft Authenticator, passkeys, or hardware security keys. We work with businesses across Brisbane and South-East Queensland on exactly this kind of security baseline work.

How do we get started?

If you’re not sure what MFA you have in place, or whether it covers every account that matters, that’s the right place to start. Get in touch with TTA and we’ll review your current setup and show you where the gaps are. No pressure, just a clear picture of where you stand.