Cybersecurity Awareness Month: Start With the Control That Stops the Most Attacks

Every October brings Cybersecurity Awareness Month, and with it a flood of advice long enough that most business owners read none of it. So here is one question instead: is multifactor authentication turned on for every account that touches your email and your financial systems?

Not most accounts. Every account, including the owner’s, including the person who insists it is inconvenient.

Why This One First

Most attacks against small and mid sized businesses do not involve anyone breaking anything. They involve someone logging in with a password that was stolen, guessed, reused from another site, or handed over on a convincing fake login page.

Multifactor authentication breaks that entire category. Even with a working password, an attacker without the second factor is stopped at the door. It is not a complete defense and nothing is, but nothing else you can turn on this month blocks as many realistic attacks for as little money.

A stolen password is only useful if it is the only thing standing in the way.

Where Businesses Leave Gaps

Most companies we assess believe they have MFA enabled. Most of them partly do. The gaps follow a predictable pattern.

• The executive exemption. Someone senior found it annoying and was quietly excluded. That account also has the most access and receives the most targeted phishing.
• Service and shared accounts. The generic mailbox, the accounting login everyone uses, the vendor portal. Convenient, untracked, and usually unprotected.
• Legacy access methods. Older protocols that bypass MFA entirely can remain enabled long after MFA is switched on, leaving an open side door.
• Text message codes only. Better than nothing, but SMS can be intercepted. An authenticator app is stronger and free.

What Else Belongs in October

If MFA is genuinely done everywhere, the next three in order of value: make sure every device receives security updates automatically, confirm your backups have been restored from and not merely taken, and run one honest phishing awareness session with your whole team.

That is a realistic month. A twenty item checklist is not.

The Ten Second Version

Ask your IT person or provider for a list of every account without MFA enabled. Not a reassurance that it is on. A list. The exceptions are usually the interesting part.

Where We Fit

We build layered security into every partnership rather than selling it as an upgrade, and MFA everywhere is the starting line, not the finish. If you are not sure where your gaps are, that is exactly what a security assessment is for.