Multi-factor authentication (MFA) requires more than a password to log in, so a stolen password alone is not enough to gain access. Because most breaches begin with compromised credentials, MFA is one of the single most effective controls any organisation can put in place. It is low-cost, widely available, and blocks the most common way attackers get in.
What multi-factor authentication is
Multi-factor authentication, or MFA, means requiring more than one thing to prove who you are when you log in. A password is one factor, something you know. MFA adds at least one more, typically something you have, like a code from an app or a hardware key, or something you are, like a fingerprint. To gain access, an attacker would need not just your password but that second factor too.
The concept is simple, and that simplicity is part of its power. MFA does not try to make passwords unbreakable. It accepts that passwords get stolen, and ensures that a stolen password on its own is not enough to get in. That single shift closes off the most common attack there is.
Why passwords alone are not enough
Passwords fail as a sole defence for reasons that are well understood and impossible to fully fix. They get phished, users are tricked into entering them on fake pages. They get stolen in breaches and traded on the dark web. They get reused across services, so one breach exposes many accounts. And weak ones get guessed. No amount of password policy fully solves these problems, because the weakness is in relying on a single secret that can be captured or reused.
The result is that stolen credentials are behind a huge proportion of breaches. Attackers do not always need to hack anything, they simply log in with a password that is not theirs. MFA is the direct answer to that reality.
How MFA stops the most common attacks
Because so many attacks rely on a stolen or guessed password, MFA is remarkably effective. When MFA is in place, an attacker who has your password still cannot log in, because they do not have your second factor. Credential stuffing, where attackers try leaked passwords across many services, largely stops working. Phishing that captures a password becomes far less useful. The single most common route in is closed.
This is why security agencies and experts consistently rank MFA among the highest-impact controls an organisation can implement. Few measures block so many attacks for so little cost and effort.
The types of MFA and which are stronger
Not all MFA is equal. The common types, from more to less resistant to attack, are broadly: hardware security keys, which are the strongest and resist phishing; authenticator apps, which generate codes or prompts and are strong; and SMS codes, which are better than nothing but weaker, because they can be intercepted or redirected.
The practical takeaway is that any MFA is far better than none, so if SMS is what you can deploy quickly, deploy it. But where you can, prefer app-based or hardware-key methods, especially for high-value accounts, because they resist the more sophisticated attacks that target MFA itself.
Where to apply MFA first
If you cannot enable MFA everywhere at once, prioritise the highest-value targets. Email comes first, because email accounts are the keys to the kingdom: they can reset passwords for other services and are a prime target. Remote access, including VPNs and anything reachable from the internet, is next, because it is directly exposed to attackers. And administrator and privileged accounts, because compromising one gives an attacker far-reaching control.
Securing these first delivers the most protection for the least effort. From there, extend MFA across all accounts and services over time.
Phishing-resistant MFA and common gaps
As MFA has become widespread, attackers have adapted, so it is worth knowing the gaps. Some attacks try to trick users into approving MFA prompts they did not initiate, or intercept SMS codes. Phishing-resistant MFA, particularly hardware security keys, defends against these more advanced techniques, which is why they are preferred for the most sensitive access.
There are also coverage gaps to watch for: legacy systems or protocols that bypass MFA, and accounts or services where it was never enabled. Attackers actively look for these exceptions, so MFA is strongest when applied consistently, without gaps for an attacker to find.
If you want help rolling out MFA effectively, closing the gaps, and prioritising where it matters most, a security risk assessment shows you where your credential risks and gaps are, and our managed detection and response watches for attempts to bypass or abuse authentication.
For guidance, see the cyber.gov.au resources on multi-factor authentication.
Frequently asked questions
What is multi-factor authentication?
Multi-factor authentication requires more than a password to log in, adding a second factor such as a code from an app, a hardware key or a fingerprint. This means a stolen password alone is not enough for an attacker to gain access.
Why is MFA so important?
Because most breaches begin with compromised credentials, and MFA closes that most common entry point. An attacker with your password still cannot log in without your second factor, which blocks credential stuffing and makes phished passwords far less useful.
What type of MFA is strongest?
Hardware security keys are the strongest and resist phishing, authenticator apps are strong, and SMS codes are weaker but still far better than none. Where possible, prefer app-based or hardware-key methods, especially for high-value accounts.
Where should you apply MFA first?
Email first, since it can reset other accounts and is a prime target, then remote access and internet-facing services, then administrator and privileged accounts. These highest-value targets deliver the most protection when secured first.
