If you’ve turned on multi-factor authentication at your business, you’ve already done more than most. MFA remains the single highest-value security control a small business can deploy, and it stops the overwhelming majority of password-based attacks cold.
But “we have MFA” is no longer the end of the conversation. Attackers adapted. Text-message codes get intercepted, approval prompts get spammed until someone taps “yes,” and phishing kits now sit invisibly between you and the real login page, harvesting your code in real time. Three separate research teams demonstrated passkey bypass techniques just this month.
None of that means MFA is broken. It means the type of MFA you use, and how you configure it, now matters as much as whether you have it. Here’s how to get it right.
What MFA Actually Does
Multi-factor authentication requires two or more different kinds of proof before granting access: something you know (a password), something you have (a phone or hardware key), or something you are (a fingerprint or face scan).
The point is simple. Passwords leak. They get reused, guessed, phished, and dumped in breach databases by the hundreds of millions. MFA means a stolen password on its own is worthless — the attacker still needs your second factor.
That’s why every cyber insurance application asks about it, why Microsoft 365 and Google Workspace push it hard, and why regulators increasingly treat its absence as negligence.
The MFA Methods, Ranked
Not every second factor offers the same protection. From weakest to strongest:
SMS text codes — better than nothing
A six-digit code by text is the most common form of MFA and the easiest to defeat. Attackers use SIM-swap fraud to convince a carrier to move your number to their device, or simply phish the code in real time. It still blocks bulk credential-stuffing attacks, so keep it if it’s all a system supports. Just don’t rely on it for email, banking, or remote access.
Authenticator app codes — solid baseline
Apps like Microsoft Authenticator, Google Authenticator, or Duo generate rotating codes on your device with no carrier involved. This closes the SIM-swap hole and is a meaningful upgrade. A patient attacker running a live phishing page can still capture the code as you type it, but you’ve eliminated the easy attacks.
Push notifications with number matching — good
Tap-to-approve prompts are convenient, which is exactly the problem. Attackers spam approval requests at 2 a.m. until a tired employee taps “approve” to make it stop — a tactic called MFA fatigue. The fix is number matching: the app shows a number that must match the one on the login screen. Microsoft and Duo both support this. Turn it on.
Passkeys and hardware security keys — best available
Passkeys and FIDO2 hardware keys (YubiKey, Google Titan, and similar) are cryptographically bound to the real website address. If an employee lands on a lookalike domain, the key simply won’t respond. There is no code to read aloud, no prompt to approve by mistake, nothing to hand over. This is what “phishing-resistant MFA” means, and it’s the standard worth working toward for administrators, executives, and anyone with access to money.
Recent research showed that passkeys aren’t magic — attackers with malware already running on a machine found ways to reuse authentication material. But that’s a much harder attack than sending a fake login page, and it reinforces a broader point: MFA is a layer, not a fortress.
Where to Turn MFA On First
Most businesses can’t roll out MFA everywhere in one weekend. Prioritize by what an attacker would actually want:
- Email. Microsoft 365 or Google Workspace. Email is the master key — it resets every other password you own.
- Remote access. VPN, remote desktop, and any system reachable from the internet. This is how ransomware crews get in.
- Banking and payroll. Anything that moves money.
- Administrative accounts. Domain admin, Microsoft 365 global admin, firewall access. These deserve hardware keys, not text codes.
- Line-of-business systems. Practice management, dealership DMS, case management, accounting, ERP.
- Everything else. Work down the list over time.
The Configuration Details That Matter
Turning MFA on is step one. These settings are what separate real protection from a checkbox:
Close the legacy back doors. Older email protocols — IMAP, POP, SMTP basic authentication — often bypass MFA entirely. Attackers hunt for them specifically. Disable legacy authentication in Microsoft 365 and verify no line-of-business app depends on it.
Watch the “remember this device” window. Convenient, and a real risk on laptops that leave the building. Thirty days is a reasonable compromise; for admin accounts, don’t allow it at all.
Protect the enrollment process. If an attacker with a stolen password can register their own authenticator, your MFA is decorative. Require MFA to change MFA settings, and restrict enrollment to trusted networks or a supervised onboarding step.
Have a real recovery plan. Someone will lose a phone. Decide in advance how you verify identity before resetting MFA — ideally in person or by video, never by email alone. Attackers routinely call help desks pretending to be locked-out employees, and that’s precisely how the RingCentral breach in this week’s news began.
Block device code authentication if you don’t use it. This legitimate sign-in flow, built for devices without keyboards, is being heavily abused to trick users into approving attacker logins. If your business doesn’t need it, disable it in Conditional Access.
Monitor for impossible logins. MFA that succeeds from Palestine, Texas at 9 a.m. and from overseas at 9:15 should generate an alert. Configuring and watching those alerts is a core piece of our cybersecurity services.
Why This Matters in East Texas
Attackers don’t skip smaller markets — they prefer them. A clinic in Tyler, a machine shop in Longview, a CPA firm in Lufkin, or a defense supplier in Texarkana holds data worth stealing but rarely has someone whose full-time job is checking whether MFA is actually enforced on every account.
There’s a compliance angle too. HIPAA’s Security Rule effectively requires strong authentication for systems holding patient data. Defense suppliers pursuing CMMC face explicit multi-factor requirements for controlled unclassified information. And under Texas law, a breach affecting 250 or more residents must be reported to the Attorney General — a filing that goes considerably better when you can document that MFA was in place.
The practical target for most businesses: authenticator apps or passkeys everywhere, hardware keys for administrators and anyone who can move money, legacy authentication disabled, and a documented recovery process. If you’re not sure where your organization stands, we can tell you in about an hour. Our managed IT services include identity configuration and monitoring, and we work with businesses across Tyler, Longview, Palestine, Texarkana, Lufkin, and the DFW metro. Get in touch if you’d like a straight look at your setup.
This Week in Security
New research defeats “phishing-resistant” MFA without breaking the crypto (August 10–11). Three teams — SpecterOps, Unit 42, and others presenting around Black Hat — demonstrated ways to bypass passkey protections by reusing signed authentication material, recovering synced private keys from Google Password Manager, and abusing Windows Hello sessions. One flaw is tracked as CVE-2026-34348 in the Windows Event Logging Service. No mass exploitation has been observed, and passkeys remain the strongest option available — but keep endpoints patched and treat malware on a laptop as a serious identity risk. (The Hacker News)
RingCentral data on 1.6 million people leaked after a social engineering attack (August 13–14). The extortion group ShinyHunters published a 280GB archive containing names, addresses, email addresses, and phone numbers after RingCentral declined to pay. RingCentral says the compromise came through a sophisticated social engineering campaign and that its core platform was unaffected. If your business uses RingCentral, expect a wave of well-informed phishing attempts. (BleepingComputer, SecurityWeek)
Unpatched GeoServer zero-day probed within hours of disclosure (August 12–13). An unauthenticated SQL injection flaw in the open-source geospatial platform was publicly disclosed with no vendor patch available; researchers saw exploitation attempts almost immediately, including from the RondoDox botnet. Municipalities, utilities, and engineering firms running internet-facing GeoServer should take it off the public internet until a fix ships. (The Hacker News)
One leaked AWS key cost 1,500 organizations their entire database (August 12–13). Beacon, a CRM used by UK charities, confirmed an attacker copied its full customer database — including file attachments — in under 90 minutes. The root cause was an AWS access key left inside publicly accessible JavaScript files on the company’s own website. A blunt reminder that your vendor’s secrets hygiene is your risk too. (The Register, SecurityWeek)
New macOS infostealer hands attackers live control of browser sessions (mid-August). AmnesiaStealer, a Rust-based infostealer spread through fake GitHub download pages and the “paste this into Terminal” ClickFix lure, harvests Keychain data, Safari cookies, and Chromium browser profiles — then lets an operator drive the victim’s authenticated browser in real time. Stolen session cookies sidestep MFA entirely, which is why endpoint protection on Macs is not optional anymore. (The Hacker News, Jamf)
Dogwood Security LLC is a veteran-owned managed IT, cybersecurity, and physical security company based in Palestine, Texas, serving East Texas and the DFW metro.