The most common way a small company loses access to its mailbox, its money or its customer data isn't spectacular. There's no hacker in a hoodie. There's a stolen password — typed by an employee into a fake login page, or leaked from some entirely different service. MFA is the one cheap thing that simply switches this scenario off. As long as you turn it on where it matters, not where it's convenient.
MFA (multi-factor authentication, commonly "two-step login") is the requirement to provide a second proof on top of your password: a code from an app, a confirmation on your phone, or a tap on a hardware key. The idea is trivial. The difficulty is that most companies enable it in the wrong order, with the wrong method, and in places where it helps no one — while skipping the accounts where it would actually matter.
Why a password alone is no longer enough
Passwords leak in bulk. Every few months some popular service loses its user database, and people reuse the same password in eight places — including their work email. Add phishing on top: an employee gets a convincing "confirm your Microsoft 365 login" email, clicks, and types the password into a page that looks identical to the real one. From that moment a stranger knows their password.
What does the attacker do with it? Rarely anything loud. The most common real-world loss in an SME is a mailbox takeover followed by quiet observation. The intruder reads correspondence for a few weeks, learns how the company invoices and who it settles with, and then at the right moment sends a message to a customer: "we've changed our bank account, please pay into the new one." The money goes to the fraudster's account. This isn't a movie plot — it's the most common reason companies call us after the fact.
One password is one click away from that disaster. A second factor means the password alone is no longer enough.
Where to enable MFA first
The rule is simple: crown jewels first. Don't switch MFA on everywhere at once — you'll drown in configuration and put your team off. Go by what hurts most when it falls into the wrong hands:
- Company email (Microsoft 365, Google Workspace). This is the absolute priority, because your mailbox resets the passwords for almost everything else. Whoever owns your email owns your company.
- Remote access — VPN, remote desktop, login panels for systems exposed to the internet.
- Admin accounts and banking. Your Microsoft 365 or domain admin account is the key to your whole infrastructure — MFA here is mandatory, ideally in its strongest form.
- ERP and systems holding data — Comarch Optima, enova365, the accounting system, the CRM. Anywhere reachable from outside.
The classic security theatre we keep seeing: MFA beautifully configured on the guest WiFi portal, while the Microsoft 365 admin account has no protection at all, with the password Company2019!. That's locking the cellar door while the safe stands open.
Not every second factor is equal
"We turned on SMS, so we have MFA" is a half-truth. Methods differ in how resistant they are:
- SMS code — better than nothing, but vulnerable to number hijacking (SIM swap) and interception. Acceptable for ordinary accounts, not for admins or banking.
- TOTP app (Microsoft Authenticator, Google Authenticator) — free, generates a code every 30 seconds, works even without signal. A sensible default for the whole team.
- Push notification with confirmation — convenient, but watch out for "MFA fatigue": an attacker spams the employee with approval requests until they tap "yes" out of irritation. Choose the variant with number matching (you have to copy digits from the screen).
- Passkeys and hardware keys (FIDO2, e.g. YubiKey) — phishing-resistant, because they can't be "handed over" on a fake page. Roughly 150–250 PLN per key. Worth setting up on admin accounts and banking access.
In practice, for a 20-person company we usually recommend: a TOTP app for everyone, and hardware keys for the two or three admin accounts and the person handling bank transfers.
A real example
At one of our clients — an 18-person accounting firm — an employee entered her Microsoft 365 password on a fake login page linked in an email "from a supplier". The attacker had the correct password. And did nothing with it.
When the attempt came from an unusual location, the system demanded a code from the Authenticator app, which the intruder didn't have. The login was blocked, the firm received an alert about the suspicious attempt and calmly changed the password. The classic scenario — mailbox takeover, weeks of observation, and a swapped bank account on a customer invoice — was shut down at the very first step.
The cost of rolling out MFA on email and VPN for 18 people: one afternoon of work and 0 PLN in licensing, because Microsoft Authenticator is free. For comparison: a single successful invoice fraud in this industry typically runs to tens of thousands of zloty that you almost never recover.
How not to lock out your own team
MFA can turn against you if you deploy it without a plan for emergencies. Four things to think through up front:
- Backup codes. Every MFA system generates one-time emergency codes. Print them and store them in a safe — that's your lifeline when someone loses a phone.
- At least two admin accounts with separate MFA. If the whole company hangs on a single admin account and that admin loses their phone on a Friday evening, you have a problem for the whole weekend.
- A phone-replacement procedure. Employees change phones. Decide in advance who re-enrols their MFA, and how, before they lock themselves out.
- Conditional access. Don't ask for a code eight times a day from the office — ask when someone logs in from a new device or an unusual location. If MFA nags people on every click, they'll start working around it, and the whole investment goes in the bin.
Where to start next week
You don't need a six-month project. You need one afternoon and a list:
- Write down the accounts that have access to email, money and customer data.
- Enable MFA on email for everyone — start with your own account and the admin accounts.
- Wherever you use SMS on admin accounts and banking, replace it with an app or a hardware key.
- Print the backup codes and set up a second administrator.
- Configure conditional-access rules so the team isn't typing a code a hundred times a day.
This isn't work you'll show off at a conference. But it's the cheapest thing you can do this week to stop a stolen password from being a death sentence for your company.
If you don't know which account to start with, or how to set up conditional access without driving everyone mad, talk to someone who deploys this in small companies every day. The first call is free and takes half an hour.
MFA isn't an add-on to security. It's the switch that makes a stolen password useless.