[{"data":1,"prerenderedAt":135},["ShallowReactive",2],{"publication:en:P140":3},{"meta":4,"copy":16,"relatedArticles":121,"terms":122,"term":123,"resourceParent":130,"glossaryParent":133},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15},"P140","\u002Fglossary\u002Fmfa","term","what is MFA","What is MFA? Authentication factors, phishing resistance and recovery","What is MFA? Factors, methods and recovery","Understand MFA factors, phishing-resistant methods, recovery and enforcement. Learn what an enabled setting does and does not prove about business account security.",[13,14],"\u002Fservices\u002Faccess-2fa-audit","\u002Fblog\u002Fai-cyber-threats-access-hygiene-employee-awareness","2026-10-30",{"intro":17,"sections":18,"checklistTitle":75,"checklist":76,"faq":82,"sources":92,"links":96,"cta":116},"MFA, or multi-factor authentication, requires proof from more than one distinct authentication factor: something you know, possess or are. It helps protect accounts when a password is exposed, but the method, enforcement and recovery paths determine the practical protection. Two passwords are not two factors, and an enabled setting does not prove that every business account or sign-in route is covered.",[19,24,52,57,65,70],{"title":20,"paragraphs":21},"What counts as a separate authentication factor",[22,23],"A password is a knowledge factor. Possession can be demonstrated through an appropriately implemented authenticator or security key. A biometric may activate an authenticator locally rather than being sent to the service. The important question is what the service actually verifies and what is required to activate the authenticator, not how many screens appear during sign-in.","Two-step verification describes a sequence; multi-factor describes the types of proof. A password followed by another memorized secret is still knowledge-based. A sign-in process can also reuse a device or session without asking the person for a new challenge each time. Evaluate the provider configuration and the specific access path before describing an account as protected by MFA.",{"title":25,"paragraphs":26,"table":29},"Compare methods by the attack they resist",[27,28],"An authenticator code can reduce exposure from a stolen password, while still being entered into a convincing fake login page. Phishing-resistant authentication binds the authentication operation to the legitimate service in a way that makes this particular credential-relay route harder. A general claim that a method is secure leaves out this distinction.","A passkey is not automatically evidence of multi-factor authentication in every implementation. Whether it is single-factor or multi-factor depends on the authenticator, activation and verified configuration. Review provider documentation and actual enrollment requirements. Also check where the credential can be restored or synchronized and how the business can recover access if a device is lost.",{"caption":30,"headers":31,"rows":35},"Questions that distinguish authentication choices",[32,33,34],"Method or setting","Question to verify","Remaining concern",[36,40,44,48],[37,38,39],"Password plus one-time code","Is an independent possession factor required?","The user may still enter a code into a phishing site.",[41,42,43],"Security key or passkey","What service binding and user verification are enforced?","Recovery and alternate sign-in paths can weaken coverage.",[45,46,47],"MFA shown as enabled","Is it enforced for this account and each relevant application?","Enrollment alone may leave exceptions or legacy paths.",[49,50,51],"Remembered session","Which session and device policies apply?","A stolen active session needs separate response.",{"title":53,"paragraphs":54},"Enrollment, enforcement and coverage are different observations",[55,56],"Enrollment means an account has registered a method. Enforcement means a policy requires it for a defined situation. Coverage asks whether that requirement reaches every relevant person, administrator, application and recovery route. A screenshot showing one enabled switch establishes very little about the rest of the environment.","For a small business, start with the email platform, domain registrar, website hosting, administrative accounts and financial services. Identify shared accounts, separate administrator roles and unattended integrations. An application identity or API token requires its own controls; asking a person for MFA does not protect every secret used by a connected system.",{"title":58,"paragraphs":59,"example":62},"Recovery is part of the definition in practice",[60,61],"A lost phone, departed employee or inaccessible recovery mailbox can turn a sensible control into a business interruption. Record who owns the account, who can reset it and how an authorized owner proves identity. Store recovery material according to the provider instructions and the business access policy, with a way to avoid a single person becoming the only recovery route.","Do not test recovery by disabling the only working administrator in production. Agree an authorized procedure, preserve a safe administrative route and document the result. A recovery code, support override or alternate email may provide another way in, so include those paths when assessing the strength of the account controls.",{"title":63,"text":64},"Illustrative coverage gap","A company enrolls staff in an authenticator but leaves a former administrator session active and a recovery mailbox under personal ownership. The enrollment is real; the conclusion that all administrative access is controlled is not yet supported.",{"title":66,"paragraphs":67},"What MFA does not establish",[68,69],"MFA is not a malware cleanup, an email-content verdict or proof that an existing session has not been stolen. It does not replace account ownership, least privilege, device protection or review of connected applications. If unauthorized access is suspected, use an incident process that considers sessions, grants, recovery changes and evidence, rather than simply adding another factor.","Avoid requesting complete recovery codes, one-time codes or authentication secrets in a support enquiry. Share the provider, the affected account role and the symptom first. An authorized technical review can then define the access needed without placing a reusable secret in a public form.",{"title":71,"paragraphs":72},"Turn the term into an acceptance question",[73,74],"Ask for a short account inventory, the required method by role, known exceptions, tested sign-in behavior and recovery ownership. Define what has been checked and what remains outside scope. This produces a decision a business owner can understand instead of a blanket statement that the company has MFA.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide. Our account-access work connects Israeli technical knowledge with the providers and access arrangements the business actually uses. The glossary explains the control; the access review service separately defines implementation, evidence and handover.","MFA coverage questions",[77,78,79,80,81],"Which accounts and administrator roles are in scope?","Which independent factors and methods are actually required?","Are alternate sign-in routes and connected applications accounted for?","Who owns recovery and backup administrative access?","What evidence confirms enforcement without exposing secrets?",[83,86,89],{"question":84,"answer":85},"Are two passwords MFA?","No, two memorized secrets remain the same kind of factor. MFA requires distinct factor types in an appropriately implemented authentication process.",{"question":87,"answer":88},"Is every passkey automatically MFA?","No, the result depends on the authenticator, activation and verified configuration. Check whether user verification is required and what the service accepts.",{"question":90,"answer":91},"Does enabling MFA remove an attacker who is already signed in?","Do not assume it does: active sessions, tokens, connected applications and recovery changes need provider-specific investigation and response.",[93],{"label":94,"url":95},"NIST SP 800-63B-4: authentication methods and factors","https:\u002F\u002Fpages.nist.gov\u002F800-63-4\u002Fsp800-63b\u002Fauthenticators\u002F",[97,100,102,105,107,110,113],{"path":98,"label":99},"\u002Fglossary","Browse cybersecurity terms",{"path":13,"label":101},"Scope an account access and MFA review",{"path":103,"label":104},"\u002Fblog\u002Femployee-offboarding-access","Remove access when an employee leaves",{"path":14,"label":106},"Connect account controls with employee awareness",{"path":108,"label":109},"\u002Fresearch\u002Fmethodology","Read our sourcing and evidence approach",{"path":111,"label":112},"\u002Fglossary\u002Fpasskeys","Understand passkeys and user verification",{"path":114,"label":115},"\u002Fblog\u002Fidentify-phishing-message","Verify the requested action before approving access",{"title":117,"description":118,"button":119,"type":120},"Understand which access paths need attention","Tell us which business platforms and roles are involved. Keep passwords, one-time codes and recovery material out of the enquiry.","Discuss account access","check",[],[],{"name":124,"aliases":125},"Multi-Factor Authentication (MFA)",[126,127,128,129],"multi factor authentication","2FA","two-factor authentication","passkeys",{"path":131,"label":132},"\u002Fresources","Website security resources and templates",{"path":98,"label":134},"Cybersecurity glossary for small businesses",1794134057484]