If Your Password Was Stolen Right Now, Would That Be Enough to Get Into Your Account?
For most people, the honest answer is yes. A password alone, no matter how strong, is just one piece of information, and once an attacker has it, nothing else stands in their way. Multi-factor authentication, or MFA, exists specifically to change that answer to no.
What MFA Actually Is
MFA requires a second piece of proof beyond a password before granting access to an account, typically a code generated on a phone, a prompt approved on an authentication app, or a physical security key. Even if an attacker has your exact password, they still need that second factor, which they do not have, to actually get in.
Why the Impact Is So Large for Such a Simple Change
Microsoft has stated directly that enabling MFA blocks over 99.9 percent of automated account compromise attempts. The vast majority of attacks attempting to break into business accounts are automated, credential stuffing, password spraying, using lists of stolen passwords from unrelated breaches, and MFA stops nearly all of them outright, regardless of how the password itself was obtained.
Why This Still Isn’t Universal
Despite how effective and low-cost MFA is, adoption remains surprisingly incomplete. The UK Government’s Cyber Security Breaches Survey 2025/2026 found that only around 47 percent of UK businesses have implemented multi-factor authentication as a standard control, meaning a significant proportion are still leaving this particular door unlocked, despite it being one of the simplest and most effective controls available.
Why Businesses Delay Turning It On
The most common reasons are not really about cost, MFA is typically free or low-cost within existing business software. It is usually about a perceived inconvenience, an extra step at login, or simply nobody having got around to switching it on across every account rather than just a few. Given the scale of protection for such a small amount of friction, this is one of the clearest cases where the barrier is habit rather than genuine difficulty.
Where MFA Needs to Actually Be Enabled
Partial implementation is a common trap. MFA switched on for most staff but not directors “because it’s inconvenient for them,” or enabled on email but not on the VPN, Conditional Access, or a legacy application, leaves a real gap that attackers, and increasingly cyber insurance providers reviewing a claim, will find. Proper MFA coverage means every user, every system, every access point, not just the ones that were easiest to configure first.
How AOIT Networks Approaches It
We have multi-factor authentication rolled out as standard across every account and access point for our partners, not selectively, because a single unprotected exception undermines the protection everywhere else.
If you are not confident MFA is genuinely enabled everywhere it should be in your business, we are happy to review it and close any gaps.
Got Questions About Your IT?
Questions about your setup? Wondering if there's a better way to do things? We're always happy to have a no-pressure conversation about your IT needs.
No sales pitch. No obligation. Just straightforward advice from people who genuinely care about getting it right.
