Multi-factor authentication (MFA) requires two or more proofs from different categories before granting access: something the person knows (a password or PIN), something they have (a phone or security key) or something they are (a fingerprint or face). That way, a stolen password is not enough on its own to get into an account.
How it works
At sign-in, the service usually checks the password first (or skips it when FIDO2 is used) and then asks for a second element: an approval in an app, a time-based code, a physical key or a message.
The NCSC, the UK's cyber security agency, ranks the types it recommends for corporate services by strength, assurance, accessibility and usability, and advises adopting them in this order where possible: FIDO2 credentials (on a trusted device or a physical key), challenge-based authenticator apps, app-based code generators, hardware code generators and, last, messages by email, SMS or call. FIDO2 keys resist phishing; codes and approvals can be obtained by deception or persistence.
Example
Illustrative example, not a real case. A company turns on MFA in Microsoft 365 for all staff, starting with administrator accounts. Months later, a review finds that an old mail application still connects through a legacy protocol that only asks for a password, so an account with MFA could be opened without a second factor that way.
The fix is to close the gap: switch off the legacy protocol, replace the application, review which service accounts cannot use MFA and decide how access is recovered when someone loses their phone, checking that this process is not easier to fool than the control itself.
Limits
The NCSC warns about three patterns that leave protection half-done: legacy protocols that allow sign-in with a password alone, accounts excluded because someone finds the second factor a nuisance and forced time-based re-authentication, which weakens authentication rather than strengthening it. NIST's guidelines (SP 800-63B) also treat account recovery as something that must be designed with care.
CISA adds known threats: flooding a person with notifications until they press accept, interception of SMS messages and fraudulent SIM swaps. Even so, approvals with number matching and code apps are a clear improvement on a password alone where FIDO2 cannot yet be used. And MFA protects the sign-in, not what follows: a stolen session can still give access.
When to call an expert
Ask for help if administrator accounts have no second factor, if you do not know which applications use legacy protocols, if you need to define the recovery process or if a customer, an audit or an insurer asks you to show that MFA covers all staff.
At Impulso Tecnológico we work on diagnosis, technical controls and training: we review which accounts hold elevated permissions and whether MFA is really in use, implement the technical controls that are missing and show the team how to use them. See our cybersecurity service, the guide to building an IT security plan or tell us about your case.
Learn more
Related glossary terms: phishing, Zero Trust, Active Directory and VPN.
Official sources: the NCSC guidance Multi-factor authentication for your corporate online services, written for large organisations and the public sector, the CISA fact sheet Implementing Phishing-Resistant MFA and the NIST digital identity guidelines SP 800-63B.