What Is Multi-Factor Authentication (MFA) and Why Does My Business Need It?
A clear, direct answer to this question — written for UK business owners and IT decision-makers.
Direct Answer
Multi-factor authentication (MFA) requires users to verify their identity using two or more factors: something they know (password), something they have (phone app or token), or something they are (biometric). MFA prevents over 99.99% of account compromise attempts — yet only 40% of UK businesses have it enabled. Every business should enforce MFA on all accounts, especially email, cloud services, and remote access. It is required by Cyber Essentials and most cyber insurers.
Key Points
What you need to know.
The Short Answer
A concise overview of what you need to know.
For UK Businesses
How this applies specifically in the UK context.
Cost Considerations
What to expect in terms of investment and ongoing costs.
Next Steps
What you should do with this information.
Quick Comparison
| Feature | Option A | Option B |
|---|
Frequently Asked Questions
Hardware security keys (FIDO2/WebAuthn) offer the highest security as they are phishing-resistant and cannot be intercepted remotely. Authenticator apps are the recommended standard for most businesses, providing strong protection without hardware costs. SMS-based codes are the weakest option due to SIM-swapping vulnerabilities, though they are still far better than no MFA. Only 40% of UK businesses have two-factor authentication enabled (DSIT 2025).
Yes. Since the 2023 scheme update, MFA is mandatory for all cloud service accounts and administrator accounts within the Cyber Essentials scope. Failure to implement MFA is one of the most common reasons for assessment failure. Cyber Essentials certified organisations are 92% less likely to claim on cyber insurance (IASME), and MFA is the single control most responsible for that reduced risk.
A phased rollout works best: start with administrator and privileged accounts, then extend to all users over two to three weeks with clear guidance and support. Use Conditional Access policies to enforce MFA based on risk — for example, requiring it for remote access or unfamiliar devices. BEC attacks increased 33% in 2025 (FBI IC3 Report), so prioritising email and financial system access for MFA enforcement yields the greatest security return.
Related Questions
Microsoft 365 Security
MFA is enforced via Conditional Access in Microsoft 365 — AMVIA configures and manages this as part of the managed M365 service.
Cyber Essentials Certification
MFA is a core requirement of Cyber Essentials — get certified and demonstrate your security posture.
Cybersecurity Guide for UK SMEs
MFA is the single most impactful security control — learn how it fits within a broader programme.