Every day, millions of login credentials leak onto the dark web. Databases of stolen passwords are available for a few dollars and attackers systematically test them on popular services and corporate systems. Even the strongest password, diligently maintained by an employee, will not help if the attacker simply buys it as part of a leaked database from another compromised service.
Microsoft states that multi-factor authentication blocks more than 99.9% of automated attacks on accounts. Yet in 2025, a large proportion of companies still have not implemented it. This article explains why MFA is today a security necessity, what types exist and how to implement it effectively.
Why a password alone is not enough
The password is known as single-factor authentication. It verifies what do you know. The problem is that passwords can be stolen in many ways without the user knowing:
- Phishing - The employee enters their password on a convincingly fake login page.
- Data breach - a password leaks from another service's database where the user also used it.
- Credential stuffing - The attacker automatically tests leaked email/password combinations on other services.
- Malware and keyloggers - Malware on an infected computer captures passwords as they are typed.
- Brute force and dictionary attacks - they still work with weak or predictable passwords.
- Social engineering - The attacker directly obtains the user's password under the guise of IT support.
Today, billions of leaked email/password pairs are freely available on the darknet. Tools such as HaveIBeenPwned.com record over 13 billion compromised records. The probability that your employees' passwords are not in any leaked database is very low.
Types of multi-factor authentication: from weakest to strongest
MFA adds a second (or third) verification factor to the password. Factors are divided into three categories: what you do you know (password, PIN), what you have (telephone, hardware key) and what else you are (biometrics). Each type of MFA offers a different level of security and practicality.
SMS code (weakest, but better than nothing)
The one-time code sent via SMS is the most widespread form of MFA. It is easy to deploy and requires nothing special from the user. The disadvantage is that SMS can be redirected by an attacker via SIM swapping or intercepted through SS7 signalling protocols. On top of that, attackers with advanced phishing kits can capture SMS codes in real time (real-time phishing). We therefore recommend SMS MFA as a minimum. It is significantly better than nothing, but insufficient for critical systems.
TOTP application (good balance of security and convenience)
Applications such as Google Authenticator, Microsoft Authenticator or Authy generate time-limited one-off codes (Time-based One-Time Password, TOTP) directly on the user's mobile phone - without network connection. Codes are typically valid for 30 seconds. This approach is more robust than SMS because the code cannot be obtained by redirecting a SIM card. The disadvantage is that advanced phishing kits can still capture it during a real-time attack.
Push notifications with number verification
The application (typically Microsoft Authenticator or Duo) displays a push notification on the phone requesting login confirmation. More advanced implementations show a number that the user must select on their phone screen, this prevents so-called MFA fatigue attacks, where an attacker floods the user with notifications until one is confirmed.
Hardware security keys (strongest)
Physical USB or NFC keys (YubiKey, Google Titan) implement the standard FIDO2/WebAuthn and are resistant to phishing: the key works only for logging into a specific domain, not on a fake page. Hardware keys are the gold standard for privileged accounts (administrators, company management, finance) and critical systems. The acquisition cost is several hundred Kč per unit.
Passkeys: The Future of Authentication
Passkeys are the new standard, combining the security of hardware keys with the convenience of biometrics (fingerprint, Face ID). Login occurs without entering a password: the user authenticates via biometrics on their device, which then cryptographically verifies the login. Passkeys are natively phishing-resistant and are gradually being adopted by major platforms (Apple, Google, Microsoft). In corporate environments, they are in the early stages of deployment in 2025, but the trend is clear.
Where to implement MFA first in a company: priorities
If you are deploying MFA gradually, start where a compromise would cause the most damage:
- Privileged administrator accounts - IT administrators, cloud service providers, database managers and network device operators. Compromise of an administrator account can lead to total takeover of the infrastructure.
- VPN and remote access - Remote access without MFA is an entry point for ransomware. This is an absolute priority.
- E-mail and M365/Google Workspace - A compromised corporate email allows an attacker to impersonate employees, access data and launch Business Email Compromise attacks.
- Cloud applications and SaaS - CRM, ERP, HR systems and other applications containing sensitive data.
- All other business accounts - The financial benefit is to protect every account, not just the critical ones.
Recommendations for deploying MFA in a company
Successful implementation of MFA requires both technical and procedural steps:
- Start with a pilot project on a small group of users, test the processes and resolve exceptions (lost phone, travel).
- Prepare users, communicate why, not just what. People accept change more readily when they understand its purpose.
- Set up safety mechanisms in case of loss of the second factor (backup codes, alternative verification via the IT department).
- Disable legacy authentication protocols (Basic Auth, IMAP without MFA) that bypass MFA.
- Consider Conditional Access, always require MFA when logging in from an unknown device or an unusual location.
MFA is one of the fundamental pillars of the security architecture described in the principle Zero TrustIf you need assistance with designing and deploying MFA in your organisation, contact the SecureOn.cz specialists - We will gladly design a solution tailored to your needs and technological environment.