3 September 2026LANTEK Computers
If you do one thing to your business’s security this quarter, do this one. Not because it is fashionable, and not because an insurer asked. Because of a structural fact about how passwords fail.
The structural argument, without a statistic attached
A password is a secret that has to travel. It gets typed on machines, stored in browsers, reused across services, written down, and shared with a colleague who needed something urgently. Every one of those is a copy you no longer control.
And the most common way a password reaches an attacker has nothing to do with your systems. A member of staff signs up to some other service using their work email address. That service is later breached. The password appears in a list. If it was also the password for your mailbox, it now works on your mailbox, and nothing about your own security was involved. This is what dark web monitoring mostly finds.
Here is the part that matters. A password used correctly by the wrong person is indistinguishable from a password used correctly by the right person. There is no malicious file, no anomaly in the traffic, nothing for antivirus to detect. The sign-in is valid.
So the defence cannot be detection. It has to be making the password insufficient. That is the whole of it: multi-factor authentication means possession of the secret is no longer possession of the account.
You will find figures quoted about how much this prevents. We are not printing one, because the ones in circulation are usually repeated without a primary source and the argument does not need one. If a stolen password alone cannot get in, the most common route in is closed.
Where to turn it on, in order
Email first, and before anything else. Email is the account that resets every other account. Whoever controls a mailbox can request a password reset almost anywhere and receive it. Securing anything else while leaving mail open is building a wall with the gate open.
Then anything that can move money. Banking, payroll, the accounting package if it is online.
Then remote access. VPN, remote desktop, anything reachable from outside the building.
Then administrative accounts, without exception. These are the accounts worth stealing and they are frequently the ones exempted for convenience.
That last point is the one to watch. The account most likely to be excluded from a rollout, because the person is senior or busy or travels, is the account an attacker most wants. An exemption for a director is not a small compromise on coverage. It is a hole shaped exactly like the target.
Not all second factors are equal
Worth knowing, without turning it into a product comparison.
An authenticator app generating a code, or an approval prompt, is the sensible default for most businesses. It is free, it works offline for code-based prompts, and it is not tied to a phone number.
A hardware key is the strongest generally available option and is worth considering for administrative accounts specifically. The cost is per key and the trade-off is that losing one is a process.
Codes over SMS are meaningfully weaker than the other two, because a phone number can be moved to another SIM. In South Africa this is a real and known risk rather than a theoretical one. SMS is still very much better than nothing, and if the choice is SMS today or an app in six months, take SMS today and improve it later.
Approval prompts alone have one weakness worth planning for: somebody bombarded with requests may eventually approve one to make it stop. If your system offers number matching, where the person has to type a number shown on the screen they are signing in on, turn it on. It costs nothing and it removes that failure.
The objections, taken seriously
These are the ones we actually hear, and dismissing them is how a rollout stalls.
It will slow everybody down. Partly true for about a fortnight, then largely not. On a device somebody uses daily, most systems can be configured to prompt periodically rather than every time. If your staff are being asked for a code several times a day, that is a configuration problem and it should be fixed rather than endured, because a prompt people resent is a prompt people find ways around.
Staff will not use personal phones for work. A fair position, and it is worth not arguing with it. The answer is a hardware key or a code generating device for anybody who declines. It costs a little and it removes the argument entirely, which is cheaper than a rollout that half the business opts out of.
What happens when somebody loses their phone. The right question, and it needs answering before the rollout rather than during. There has to be a defined way to get somebody back in, and it has to be more robust than a colleague vouching for a voice on the telephone, because that route is itself an attack. Decide it, write it down, and make sure more than one person can operate it.
We are too small to be a target. The attacks discussed here are not aimed at anybody. They work through lists of credentials that already exist. Being small does not remove you from a list.
It will break the old application. Sometimes true, and worth establishing early. Legacy systems that cannot support a second factor need a different control around them rather than an exemption that quietly reopens the gap.
How to roll it out without a mutiny
Announce a date and say why, in terms of the business rather than compliance. Start with the IT-literate and the leadership, so nobody can claim it was imposed on them from above. Give people a choice of second factor. Run a session where you enrol people in person, because the enrolment is the only genuinely fiddly part. Then enforce it, with a stated cut-off, because an optional security control has an adoption rate rather than a coverage figure.
Do not skip the recovery process, and do not leave it undocumented.
What it does not solve
Being honest about the limits keeps expectations right. It does not stop somebody being persuaded to approve a prompt they should not have. It does not help if an attacker already has an active session. It does not protect an account somebody has been talked into handing over. And it does nothing about the fraud that follows once a supplier’s mailbox is the compromised one rather than yours, which is why the telephone verification rule in how business email compromise works matters alongside it.
It closes the most common door. That is a large thing to close for the cost.
How this fits with everything else is on Cybersecurity. If you would like to know which of your addresses and passwords are already circulating before you start, the free dark web scan answers that in thirty minutes.