If you do one security thing this quarter, turn on multi-factor authentication everywhere it will go. It removes an entire category of attack: credentials bought in bulk, reused from another breach, or guessed. That is most opportunistic intrusion, gone.
It is also worth being precise about what it does not stop, because overstating it is how organisations end up surprised.
What it stops cold
- Password spraying and credential stuffing
- Reused passwords surfacing from an unrelated breach
- An old password still working after somebody leaves
What it does not stop
Adversary-in-the-middle phishing proxies the real login page and relays the code in real time, so the second factor is captured along with the first. Session token theft skips authentication entirely by stealing the cookie after a legitimate login. And push fatigue, where somebody approves the fifth prompt at 11pm to make it stop, defeats the control with no technical sophistication at all.
What closes those gaps
Number matching instead of simple approve prompts. Phishing-resistant factors, meaning passkeys or hardware keys, for administrators first. Conditional access so a session from an unmanaged device or an unexpected country is challenged. And sign-in log alerting, because token theft looks like a normal login unless somebody is watching where it came from.
None of that argues against MFA. Turn it on today. Then treat it as the floor rather than the finish line.