# MFA and password managers: the cheapest protection for SMEs

URL: https://casterconsulting.hu/en/mfa-password-management-smes/
Published: 2026-10-15
Updated: 2026-10-15
Author: Caster Consulting

> Multi-factor authentication is the cheapest and most effective protection an SME can add: Microsoft's research found it cuts the risk of account compromise by more than 99%. The order: email and office accounts, administrators, remote access, then a company password manager.

**Short answer: multi-factor authentication (MFA) is the cheapest and most effective protection an SME can add.** Microsoft's research found it cuts the risk of account compromise by more than 99%, and most office suites include it at no extra cost. The order is simple: email and office accounts first, then administrators, remote access and financial systems, and finally a company password manager for everyone.

If an SME can take only one cybersecurity step this year, it should be this one. It needs no new hardware, no big project, and the effect is immediate. And people already know it from online banking and social media, so it rarely meets serious resistance.

## Why it matters so much

Most attacks don't break through the firewall; they walk in with a stolen password.

- **Microsoft's 2025 Digital Defense Report** says more than 97% of identity attacks are password attacks, and such attacks rose by about 32% in the first half of 2025. The same report says phishing-resistant MFA stops more than 99% of them.
- **Sophos's 2026 ransomware survey** found compromised credentials were the root cause in 23% of attacks.
- **Verizon's 2026 report** found exploiting vulnerabilities is now the most common way in (31%), but stolen credentials remain among the main routes.

Microsoft Research's 2023 study measured how much MFA matters: the risk of compromise was 99.22% lower with MFA, and still 98.56% lower when the password had already leaked. The two Microsoft figures come from separate studies, but they say the same thing: **a second factor stops almost every password-based attack.**

## Which second factor?

Not all second factors are equally strong. According to the US cybersecurity agency CISA, from strongest to weakest:

1. **Security key or passkey (FIDO2/WebAuthn):** CISA calls this the "gold standard", because it doesn't work on a phishing site. Use it for your most critical accounts.
2. **Authenticator app with one-time codes (TOTP):** a good choice for most users, and much stronger than SMS.
3. **Push notification in an app:** convenient, but according to CISA vulnerable to "push bombing", where the attacker keeps sending approval requests until the user accepts one by mistake. Number matching reduces this risk.
4. **SMS or voice call:** the weakest, because phone numbers can be hijacked (SIM swapping).

CISA is clear, though, that any MFA is better than none. If a system only supports SMS, switch it on and plan the move.

## The password manager: the other half

Alongside MFA, passwords need sorting out too. The problem isn't that people choose weak passwords; it's that nobody can remember fifty strong, unique ones. So they reuse them, and one leaked password opens several accounts.

The UK's National Cyber Security Centre (NCSC) recommends password managers. A company password manager:

- generates and stores a strong, unique password for every account;
- lets teams share common accounts securely;
- lets you revoke access in one place when someone leaves.

Important: protect the password manager itself with MFA, as the NCSC stresses. It holds the keys to everything else, so it deserves the strongest login you have.

What to look for in a company password manager:

- **central administration:** adding and removing users in one place, with immediate revocation when someone leaves;
- **shared vaults:** passwords shared per team or project, with permissions;
- **MFA and single sign-on (SSO)** with the company account;
- **audit log:** who accessed which password, and when;
- **emergency access:** if a key person is unreachable, the company shouldn't lock itself out of its own accounts.

## Passkeys: life after passwords

A passkey replaces the password with a cryptographic key stored on your device, unlocked by fingerprint, face recognition or a PIN. It can't be stolen on a phishing site and can't be forgotten. According to the NCSC, passkey logins are often eight times faster than password logins.

More and more services support them, and in an SME it's worth introducing them now for management and administrator accounts. Register at least two passkeys or keys per account, so a lost device doesn't lock the user out.

## Rollout order in an SME

1. **Email and office accounts** (Microsoft 365 or Google Workspace): every password reset lands here, so it matters most. Both suites let you switch it on at no extra charge.
2. **Administrator accounts:** with a security key or passkey, and a separate admin account not used for daily work.
3. **Remote access:** VPN, remote desktop, cloud consoles.
4. **Financial systems:** online banking, accounting software, invoicing.
5. **All other business applications,** wherever available.
6. **A company password manager** for everyone, protected with MFA.

## A one-month rollout plan

- **Week 1:** inventory. Which accounts exist, who already has MFA, which systems don't support it. Send the team a short note: why, when, how.
- **Week 2:** email and office accounts. Management and administrators first, then everyone, on a set day, with help on hand.
- **Week 3:** remote access and financial systems, plus a test of the recovery process with a "lost phone" drill.
- **Week 4:** introduce the password manager, move shared accounts into a shared vault, and replace old passwords everyone knows.

In a month, an SME can make most of its accounts far more secure without significant investment. After that, review it once a quarter: new starters, new systems and new supplier portals are where gaps reappear.

## Practical obstacles

**"I lost my phone."** Have a recovery process in place: who verifies the person's identity, and how they get new access. Don't send new codes by email; that's exactly what attackers exploit.

**Shared accounts.** If several people use one account (a shared mailbox or a supplier portal), a shared vault in the password manager helps. Better still, give everyone their own account and grant access to the shared resource by permission.

**Resistance.** The first week is a little inconvenient, then it's habit. Explain why it matters and show how little an authenticator app or passkey slows down a login.

**Legacy systems.** Some older software can't do MFA. List them, and either put them behind another layer (for example reachable only via VPN) or plan a replacement.

## Common mistakes

**Mandatory only for new accounts.** Old accounts without MFA remain the weakest points. Switch it on for everyone, with a deadline.

**"Temporary" exceptions.** The executive account that's "too busy right now" is the most valuable target. Exceptions only if documented and time-limited.

**Recovery as the weak spot.** If anyone can get a new code with a phone call, so can an attacker. Define identity checks in advance.

**Forgetting supplier portals.** Bank, domain registrar, hosting and accounting accounts are often the most critical, yet get left out of the first round.

## What MFA doesn't fix

MFA is the single best step, but not a guarantee. Some phishing sites act as a relay: the user types their password and one-time code into a fake page, and the attacker passes them on to the real service in real time. Codes from apps and SMS can be intercepted this way; security keys and passkeys can't, because they check which site they're talking to. That's why CISA recommends phishing-resistant methods for the most important accounts.

MFA also doesn't protect against unpatched software, which Verizon now lists as the most common way in, or against a compromised laptop. So treat it as the first layer, not the only one: keep systems updated, keep tested backups, and train people to recognise phishing. Together with MFA, those three cover the routes most attacks actually take.

## What it costs

Almost nothing. MFA built into Microsoft 365 and Google Workspace costs nothing extra, and authenticator apps are free. Company password managers are billed per user per month, and security keys are a one-off cost each. Compared with a compromised email account or a ransomware attack, it's negligible.

## How to explain it to your team

Success depends on people understanding why. A short, plain message is enough: passwords get stolen regularly, and a second step at login removes almost all of that risk. Show live how long a login takes with an authenticator app or a passkey, and name someone people can turn to for help in the first days. Most resistance comes from the fear of being locked out; knowing help is quick makes people relax.

## NIS2 and compliance

Multi-factor authentication is listed among the risk management measures in the EU's NIS2 directive. If your company falls under NIS2, or supplies one that does, MFA is no longer a recommendation but an expectation.

## What to do now

1. **Switch on MFA for email and office accounts** for everyone, this week.
2. **Move to an authenticator app** wherever you use SMS today.
3. **Protect admin and management accounts** with a security key or passkey.
4. **Switch it on for remote access and financial systems** too.
5. **Introduce a company password manager,** protected with MFA, and move shared accounts into it.
6. **Write down the recovery process** for a lost phone, and test it once.

If you'd like someone to take you through the rollout, from reviewing accounts to training staff, have a look at our [infrastructure and operations](/en/infrastructure/) and [modern workplace and cloud](/en/modern-workplace/) services.

## FAQ

### How effective is multi-factor authentication?

Microsoft Research's 2023 study found it cuts the risk of account compromise by 99.22%, and by 98.56% even with a leaked password. Microsoft's 2025 report says phishing-resistant MFA stops more than 99% of password attacks.

### Is an SMS code enough?

Better than nothing, but the weakest option, because phone numbers can be hijacked. Use an authenticator app or a security key instead.

### What is a passkey?

Login without a password, using a cryptographic key stored on your device and unlocked by fingerprint, face recognition or a PIN. It doesn't work on phishing sites, and the NCSC says it's often eight times faster than a password login.

### Do we need a password manager if we have MFA?

Yes. MFA adds the second factor; the password manager makes sure every account has a strong, unique password. Together they really protect you, and the password manager itself needs MFA too.

### What does it cost to roll out MFA?

It's included at no extra cost in Microsoft 365 and Google Workspace, and authenticator apps are free. A company password manager and a few security keys are the main costs, negligible compared with the damage of a compromised account.

## Sources

- [Microsoft Research – How effective is multifactor authentication at deterring cyberattacks?](https://www.microsoft.com/en-us/research/publication/how-effective-is-multifactor-authentication-at-deterring-cyberattacks/)
- [Microsoft – Digital Defense Report 2025 (On the Issues)](https://blogs.microsoft.com/on-the-issues/2025/10/16/mddr-2025/)
- [CISA – Implementing Phishing-Resistant MFA (fact sheet)](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)
- [CISA – More than a Password](https://www.cisa.gov/MFA)
- [NCSC UK – Trusting the tech: using password managers and passkeys to help you stay secure online](https://www.ncsc.gov.uk/blog-post/trust-the-tech-using-password-managers-passkeys-to-help-you-stay-secure-online)
- [Sophos – The State of Ransomware 2026](https://www.sophos.com/en-us/blog/sophos-state-of-ransomware-2026)
- [Verizon – 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/)