Cybersecurity basics
What is multi-factor authentication, and do I need it?
Reviewed by the Privacy Horizon team · Last reviewed
Quick answer
Multi-factor authentication (MFA) requires a second proof of identity in addition to your password — typically a code from an app, a hardware key, or a biometric. Because it means a stolen password alone is not enough to log in, MFA blocks the vast majority of account-takeover attacks. Yes, you need it: enable MFA on email, financial, and administrator accounts first, and prefer an authenticator app or hardware key over text-message codes.
On this page
How MFA works
Authentication factors fall into three categories: something you know (a password or PIN), something you have (a phone, authenticator app, or hardware key), and something you are (a fingerprint or face scan). MFA combines at least two different categories, so compromising one — like a leaked password — is not enough to get in.
Not all MFA is equally strong
- Hardware security keys (FIDO2/WebAuthn): the strongest, phishing-resistant option — recommended for administrators and high-value accounts.
- Authenticator apps (TOTP) and push approvals: strong and convenient for most users; far better than SMS.
- SMS text codes: better than nothing, but vulnerable to SIM-swapping and interception — avoid for sensitive accounts where stronger options exist.
Where to turn it on first
Prioritize the accounts that unlock everything else: email (which controls password resets), banking and payments, cloud and IT administrator consoles, and any system holding customer or employee personal information. Then extend MFA to all business applications that support it.
Frequently asked questions
2FA is MFA with exactly two factors. MFA is the broader term for any scheme using two or more factors. In everyday use the terms are often interchangeable.
Increasingly, yes. MFA is an expected control in frameworks like SOC 2 and ISO 27001, is commonly required by cyber-insurance providers, and appears in customer security questionnaires. Even where not strictly mandated, its absence is a notable gap.
Keep exploring
All Cybersecurity basicsHow can I protect my personal and business information from cyberattacks?
A practical, layered approach to protecting personal and business information from cyberattacks: MFA, patching, backups, training, and a tested incident plan.
ReadCybersecurity basicsHow can I protect my business from ransomware and phishing?
Defend against ransomware and phishing with immutable backups, patching, MFA, email filtering, least privilege, network segmentation, and staff training.
ReadCompliance & regulationsHow do we prepare for a customer security questionnaire?
Customer security questionnaires (SIG, CAIQ, and custom) gate enterprise deals. Prepare with a control framework, ready evidence, a reusable answer library, and an owner.
ReadCybersecurity basicsWhat's the difference between data privacy and cybersecurity?
Data privacy governs how personal information is collected, used, and shared; cybersecurity protects information and systems from threats. Here's how they differ and overlap.
ReadCompliance & regulationsWhat is a cybersecurity risk assessment, and how often should we do one?
A cybersecurity risk assessment identifies threats to your data and systems and how to manage them. Do one at least annually and after any significant change.
Read