You enter a password, approve something on your phone, and get on with your day. That extra step is familiar enough that it is easy to assume every account has the same protection. It doesn’t. The method you use, the recovery process, and the settings behind it all matter.
Multifactor authentication, or MFA, combines different kinds of evidence that you are allowed to sign in. Two passwords are still the same kind of evidence. A password plus a properly enrolled security key is different. For a business, the useful question is which approach protects the account without turning every working day into a support ticket.
Why a code and a security key are different
A code sent by text or generated in an authenticator app adds protection beyond a password. But a convincing fake sign-in page can ask you for that code and relay it to the real service. A push request can also be approved by someone who did not start the sign-in. These are reasons to improve MFA, not reasons to give up on it.
Phishing-resistant methods, including supported FIDO security keys and passkeys, use cryptographic authentication tied to the legitimate service. They do not work by handing an attacker a reusable sign-in code. CISA recommends phishing-resistant MFA. The exact options available depend on your applications, devices, and licensing.
Source: CISA guidance on multifactor authentication
Start with the accounts that can do the most damage
Email deserves early attention. It often receives password resets and carries the conversations that customers trust. Administrator accounts, financial systems, remote access, and the password manager also belong near the top of the list. Check actual enforcement rather than assuming enrollment means everyone is covered.
- Confirm which sign-in methods are allowed and remove weak alternatives where appropriate.
- Review recovery contacts and help desk verification so recovery does not become the easy way around protection.
- Plan for a lost phone or key before someone is locked out during a busy day.
- Document exceptions, the reason for each one, and when it will be reviewed.
Roll it out around real work
A shared front-desk workstation, a traveling employee, and a contractor may need different enrollment and recovery arrangements. Start with a small group, explain the change, and make help easy to reach. Security that people understand is easier to maintain than a rule they have learned to work around.
RIKR works from a security baseline, then considers how your team actually operates. We can help review identity settings and the tradeoffs involved. Some capabilities require additional Microsoft, Google, or other software licensing; they should be discussed rather than assumed to be included.
MFA does not replace the rest of the plan
An already authenticated session can still be exposed through a compromised device or other attack paths. Keep endpoints protected, monitor identities, and know how suspicious activity gets investigated. Treat MFA as an important control with a defined job, not a promise that an account can never be compromised.
Read next: how stolen sessions can bypass the sign-in you already completed
Explore RIKR managed cybersecurity
Written by Joshua Price
Back to the blog