Published: 14 May 2026 | By AOLC
Passwords have been the gatekeeper of business data for decades. The problem is that passwords are now one of the weakest links in your security chain. They get stolen in phishing attacks, leaked in data breaches, reused across dozens of accounts, and cracked by automated tools in a matter of hours. In 2026, relying on a password alone is the cybersecurity equivalent of locking your front door and leaving the window open.
Multi-factor authentication — MFA — is the fix. It is not complicated, it does not require expensive hardware, and it is available right now in the tools your business almost certainly already uses. Yet a significant portion of South African businesses have still not switched it on. This article explains what MFA is, why it matters more than ever, and how to roll it out across your organisation.
Microsoft reports that MFA blocks more than 99.9% of automated account attack attempts. If your team is not using it, your accounts are effectively undefended against the most common attack vector in use today.
Multi-factor authentication is a security method that requires users to verify their identity using two or more independent factors before they can access an account or system. The three categories of factors are:
When you combine two of these factors, a stolen password is no longer sufficient to break into an account. An attacker would also need physical access to your phone or your fingerprint — a dramatically higher bar. Two-factor authentication (2FA) is the most common implementation and is what most businesses enable first: a password plus a one-time code sent to your phone or generated by an authenticator app.
of automated account attacks are blocked by MFA, according to Microsoft. It is the single most effective access control measure available to businesses today.
The threat landscape has changed fundamentally. Here is what is working against a password-only approach in 2026:
Tip
Start with your highest-risk accounts: Microsoft 365, Google Workspace, banking portals, and VPN access. These are the accounts attackers target first and the ones that cause the most damage when compromised.
Not all MFA methods offer the same level of security. Here is a quick overview from least to most secure:
| Method | How It Works | Security Level |
|---|---|---|
| SMS one-time code | Code sent to your phone number via SMS | Good — better than nothing, but SIM-swap attacks are a known risk |
| Authenticator app | Time-based code from Microsoft Authenticator, Google Authenticator, or similar | Very good — not tied to your SIM, works offline |
| Push notification | Approve or deny a login request on your phone | Very good — watch for MFA fatigue attacks (repeated push spam) |
| Hardware key (FIDO2) | Physical USB or NFC key (e.g. YubiKey) you plug in or tap | Excellent — phishing-resistant, the gold standard for high-risk accounts |
For most South African businesses, an authenticator app is the right starting point. It is free (Microsoft Authenticator is included with Microsoft 365), easy to deploy, and significantly more secure than SMS codes. Hardware keys are worth considering for executives, IT administrators, and anyone with access to financial systems.
South Africa's Protection of Personal Information Act (POPIA) requires organisations to implement appropriate technical and organisational measures to protect personal information. Section 19 of POPIA specifically mandates that responsible parties take steps to prevent loss, damage, destruction, or unlawful access to personal information.
When a business account containing customer data, employee records, or financial information is breached because MFA was not enabled, this becomes a POPIA concern — not just an IT problem. The Information Regulator has the authority to issue enforcement notices and impose fines. More importantly, a breach triggers a mandatory notification obligation to both the Regulator and affected data subjects.
Enabling MFA is one of the fastest ways to demonstrate to auditors, clients, and regulators that your business takes data protection seriously — and it costs nothing to switch on in Microsoft 365 or Google Workspace.
If your business handles personal information — and almost every business does — MFA should be considered a minimum baseline control, not an optional extra. Our cloud and security services include MFA configuration and ongoing security monitoring as standard.
Rolling out MFA does not have to be painful. A phased approach minimises disruption and ensures your team understands why the change is happening. Here is a practical sequence for most South African businesses:
cost to enable MFA on Microsoft 365 using Security Defaults or the Microsoft Authenticator app. There is no technical or financial barrier to switching it on today.
Tip
Watch out for MFA fatigue attacks: attackers send repeated push notification requests at 2 AM hoping a sleepy employee taps “Approve” to make them stop. Counter this by enabling number matching in Microsoft Authenticator — users must enter a number shown on the login screen, making blind approvals impossible.
Despite its clear benefits, MFA adoption is still held back by a handful of recurring objections. Here is how to address them:
If your business has not yet enabled MFA, here is a practical checklist to get started this week:
The managed security services AOLC provides include MFA deployment, Conditional Access policy configuration, and ongoing monitoring for suspicious sign-in attempts — so you have visibility if someone is trying to get in, even if MFA is blocking them.
Not sure where your MFA gaps are? AOLC will audit your Microsoft 365 or Google Workspace environment and configure MFA correctly — no disruption, no IT jargon.
Book a Security Assessment