Multi-factor authentication requires a second factor, such as an authenticator app, a push approval or a hardware key, in addition to a password for email, remote access and admin accounts.
My pickCisco DuoCisco Duo is easy to roll out, covers a broad range of apps and VPNs, and is free for small teams.
SMS codes are better than nothing, but they can be intercepted. App-based push with number matching is stronger, and phishing-resistant FIDO2 security keys and passkeys are the strongest. Compare how well each option covers legacy apps and VPNs, not just SaaS.
Why it works
Missing MFA on email and remote access is among the most cited causes of cyber claims, and many carriers will not write a policy without it.
What to look for
Admins should have phishing-resistant options such as FIDO2 keys or passkeys.
It should cover email, VPN, remote desktop and privileged accounts.
It should use number matching or a similar defense against push fatigue.
Products I track for Multi-factor authentication (MFA)