Multi-factor Authentication is destined to fail where endpoints and permissions are poorly governed.
Multi-factor authentication (MFA) is an essential security control that requires users to verify their identity using more than one method, typically something they know (like a password) and something they have (like a mobile app code or hardware token). It is a key requirement in protecting against stolen credentials and is considered essential for securing cloud platforms and business logins.
For many small and mid-sized businesses (SMBs), enabling MFA feels like checking off a major security milestone, and in some ways, it is. But here’s the uncomfortable truth: turning on MFA is not the same as being secure.
Cyber attackers have evolved, and they now routinely bypass MFA without needing to crack passwords. At the same time, many businesses run on a mix of unmanaged devices and over-permissioned user accounts, conditions where MFA does little to stop breaches. This article explores where MFA falls short and what SMBs must do to reduce cybersecurity risk.
MFA Is a Control, Not a Cybersecurity Strategy
MFA solves the problem of verifying the person who is logging in is actually who they claim to be.
What it does not do is:
- Prevent malware infections
- Protect poorly secured laptops or mobile devices
- Detect unusual user behaviour after login
- Block unauthorised lateral movement across the network
- Fix overly generous user permissions
- Limit the damage of an already compromised account
MFA is an essential layer in a broader security model, but treating it as a complete strategy is like installing a sturdy door lock and leaving your windows open.
How Do Attackers Bypass MFA?
Session token theft
Cloud platforms use session tokens to avoid repeated logins. Once a user completes MFA, the session token acts as proof of identity. If an attacker steals that token, they may gain access without needing to trigger MFA again. This method is increasingly used in modern breaches.
Real-time phishing
Some phishing kits now work as real-time proxies. The victim logs into what appears to be a legitimate site, enters their password and MFA code, and the attacker uses those details instantly. Even users who follow best practices can fall victim.
MFA push fatigue
Attackers may trigger repeated MFA push notifications to a user’s device, hoping the person eventually approves one out of confusion or annoyance. This tactic has succeeded even against large organisations.
Poor Endpoint Security Undermines MFA
Even when MFA works as designed, it does not verify that the device being used is safe.
MFA cannot stop:
- Keyloggers that record everything typed
- Remote access tools that hijack user sessions
- Malware stealing cookies or tokens from browsers
- Attackers using saved credentials on compromised devices
Many SMBs deploy MFA on Microsoft 365 or Google Workspace but neglect their device fleet.
Common issues include:
- Outdated operating systems
- Missing security patches
- Consumer-grade antivirus
- Shared or unmanaged devices
- Lack of disk encryption
- No central monitoring or policy enforcement
In this environment, an attacker may not even need to break through MFA—they can simply hijack the device already logged in.
Governance of user permissions is a must
Even with secure logins and clean endpoints, SMBs are exposed if user permissions are not well governed.
In many businesses:
- Staff retain access to systems they no longer use
- Temporary admin rights are never removed
- Shared drives or mailboxes are too widely accessible
- Departed employees’ accounts remain active
- Service accounts run with full privileges
This setup means that a single compromised account could expose sensitive financial data, customer records, or even allow attackers to reset passwords and escalate access further.
MFA doesn’t control what a user can do once logged in. That’s every organisation needs a well developed off boarding policy that is administered and is reviewed regularly by your IT provider.
MFA Doesn’t Stop Internal Threats or Lateral Movement
Modern attackers don’t just try to log in from the outside. Once inside, they use legitimate tools and processes to move across the network. They may:
- Access email systems to manipulate invoices
- Escalate privileges using unpatched vulnerabilities
- Transfer data out via trusted channels
- Use built-in tools like PowerShell to maintain access
MFA typically plays no role in detecting or stopping these activities after login. That’s why organisations need visibility and controls that go beyond the authentication layer.
A More Practical Approach for SMBs
MFA remains important. Every business should use it. But it must be part of a broader, layered strategy.
Here’s where SMBs should focus:
As an SMB using an IT service provider, that provider should include these components in your service plan with you:
1. Secure your endpoints
- Keep systems patched and up to date
- Use business-grade endpoint protection
- Enforce disk encryption
- Remove unnecessary local admin rights
- Apply standard builds and compliance checks
An authenticated user on a compromised device still poses a major threat.
2. Implement strict access controls
- Use least privilege principles
- Apply role-based access to systems and data
- Regularly review and update permissions
- Remove unused accounts and services
- Separate admin accounts from daily use accounts
This limits how far attackers can go if one account is compromised.
3. Monitor identity and behaviour
Even small businesses should turn on:
- Login and access logging
- Alerts for unusual sign-in locations or times
- Detection of new admin accounts or rule changes
- Analysis of impossible travel activity (logins from distant locations in short timeframes)
This helps detect threats that slip past initial controls.
4. Strengthen your MFA implementation
Not all MFA is created equal.
- Avoid SMS-based MFA where possible
- Use app-based authentication or hardware tokens
- Enable number matching or phishing-resistant methods
- Combine MFA with conditional access policies
Modern MFA should be adaptive and harder to socially engineer.
Final Thoughts
Multi-factor authentication is a strong and necessary control, but it’s not a standalone strategy. Cyber threats today are more sophisticated and multi-layered. Attackers target endpoints, abuse permissions, and move laterally inside networks long after MFA is completed.
Real security requires layered defences. That means combining MFA with secure endpoints, access controls, monitoring, and a clear understanding of what users and systems can actually do once access is granted.
At Computer Troubleshooters, we help Australian businesses build realistic and effective cybersecurity strategies tailored to their size, systems, and risk.
We go beyond checkboxes like MFA and help you address the full picture, from device health to identity governance. If you’re ready to strengthen your defences, we’re here to help you make it happen.
Contact us today at 1300-123-456 or email us at info@computertroubleshooters.com.au for a consultation on how we can support your business’s security strategy.
Let’s build a safer, more resilient future together.
Article PDF: