What is multi-factor authentication?

SMS is considerably better than a password alone and still blocks the large volume of automated credential-stuffing attacks that rely on reused passwords. Its weaknesses are specific: SIM swap fraud, where an attacker persuades a mobile operator to transfer a number; interception in some network conditions; and phishing pages that relay the code in real time. For general staff accounts, SMS is an acceptable interim step if the alternative is nothing. For administrators, finance staff and anyone able to move money or change bank details, an authenticator app with number matching or a hardware key is the appropriate standard.

Yes. Current Cyber Essentials requirements mandate multi-factor authentication on cloud services, and specifically on administrative accounts. The requirement applies to services accessible from the internet — Microsoft 365, Google Workspace, cloud-hosted line-of-business applications and remote access. Missing or partially deployed MFA is one of the most common reasons organisations fail their first assessment attempt, typically because it is enabled for some users but not enforced for all, or because legacy authentication protocols remain enabled and allow sign-in without it.

An MFA fatigue or prompt-bombing attack occurs when an attacker already holds a valid password and repeatedly triggers authentication requests, sending a stream of push notifications to the legitimate user's phone. The intent is that the user eventually approves one — through confusion, irritation, or while distracted — often at an inconvenient hour. Several significant breaches have started this way. The countermeasure is number matching, where the user must type a number displayed on the sign-in screen rather than simply tapping approve, combined with alerting on repeated failed attempts. Staff should also be told explicitly to report unexpected prompts.

Passkeys are cryptographic credentials stored on a device or in a password manager, based on the FIDO2 standard. Rather than transmitting a shared secret, the device proves possession of a private key to the specific site it was registered with, and unlocks it with a biometric or PIN. Because the credential is bound to the legitimate domain, a phishing site cannot use it — which defeats the attacker-in-the-middle technique that captures one-time codes. Passkeys are not replacing MFA so much as becoming its strongest implementation, combining possession and inherence in a single, phishing-resistant step.

Poorly configured MFA does. Well-configured MFA rarely does. The disruption people remember usually comes from prompting on every sign-in, on every device, several times a day. Conditional access policies avoid that by evaluating risk: trusted, compliant, managed devices on known networks can be granted longer sessions, while sign-ins from unfamiliar locations, unmanaged devices or anomalous conditions trigger a challenge. With sensible policy, most staff authenticate fully once every few days. The practical cost is close to negligible relative to the compromise it prevents.