Updated November 2026
The short version
- MFA combines something you know, something you have and something you are.
- It blocks many attacks that rely on stolen or guessed passwords.
- Not all MFA is equal. CISA calls phishing-resistant MFA the standard to aim for.
- A business password manager pairs well with MFA by giving every account a strong, unique password.
What MFA means
CISA describes MFA as a layered approach to securing accounts: before a service grants access, you must provide a combination of two or more authenticators to prove who you are. You may also see it called two-factor authentication (2FA), two-step verification or 2-step authentication.
Two-factor authentication is a type of MFA that uses exactly two factors. MFA can use two or more.
The three kinds of factors
- Something you know: a password or PIN.
- Something you have: a phone with an authenticator app, a smart card or a hardware security key.
- Something you are: a fingerprint or face scan.
Using two different kinds is what makes MFA strong. A password plus a security question is still two things you know.
Why MFA matters for business
CISA notes that attackers are increasingly able to phish or harvest passwords and take advantage of passwords reused on other systems. MFA makes it much harder for them to get into systems such as remote access, email and billing, even when a password has been stolen.
Microsoft lists three common attacks MFA helps stop:
- Phishing: tricking people into handing over their passwords.
- Credential stuffing: trying passwords stolen in other breaches.
- Brute force: guessing passwords over and over.
MFA also plays a key role in zero trust, where each person and device is checked before access is granted.
Not all MFA methods are equal
CISA says some MFA methods protect better than others, but any MFA is better than none.
- Phishing-resistant (FIDO security keys and passkeys)
- How it works: A cryptographic key on a device or security key confirms the sign-in
- What to know: CISA calls this the standard to strive for; it blocks sign-ins on fake websites
- Authenticator app with number matching
- How it works: You type a number shown on screen into an app to approve
- What to know: CISA recommends it when phishing-resistant MFA is not yet possible
- Text message, voice call or simple app prompt
- How it works: You enter a one-time code or tap to approve
- What to know: Better than a password alone; number matching helps block repeated push prompts and text-message attacks
CISA urges organizations to plan a move to FIDO-based sign-in, because it stops a sign-in when someone is tricked into using a fake website.
Where to turn on MFA first
Start with the accounts an attacker would most want:
- Email, since it can be used to reset other passwords
- Remote access to company systems
- Billing, banking and payment systems
- Cloud apps that hold customer or company data
- Administrator accounts
Why business password managers pair with MFA
MFA protects the sign-in. A password manager protects the password. CISA describes a password manager as a program that creates, stores and fills in passwords, warns about weak or reused passwords and means you only need to remember one strong password.
That matters because reused passwords are what credential stuffing attacks exploit. CISA recommends passwords that are long (at least 16 characters), random and unique to each account, which is close to impossible to manage without a password manager.
CISA also notes that even a complex password, or a password manager, can be bypassed by attackers, which is why it recommends MFA on top. Used together, a stolen password is less likely, and a stolen password alone is not enough.
MFA covers
- A password that is phished or stolen
- Logins from someone who should not have access
- Sign-ins to email, remote access and key apps
A password manager covers
- Weak and easy-to-guess passwords
- The same password reused across accounts
- Staff writing passwords down or saving them in files
How 5x5 Telecom can help
5x5 Telecom provides MFA and business password managers, along with phishing and social engineering protection and training, email security and dark web monitoring that watches for company email addresses and passwords appearing in breached data. The services in your plan are set in your service agreement.
Start with a free security consultation: a look at how your network, devices and staff are protected today, a few questions and general recommendations. Detailed testing and hands-on work are scoped in the plan we propose.