Stolen credentials were the starting point for 22% of breaches in Verizon's 2025 Data Breach Investigations Report, more than any other route, and Microsoft says multifactor authentication can block more than 99.2% of account compromise attacks. Those two numbers explain why MFA is the first control most security teams ask for. This guide looks at what the data shows, where MFA still fails, and how a small company can roll it out well.
What the numbers say about MFA
Microsoft's figures are the most widely quoted. Its Entra documentation states that MFA can block more than 99.2% of account compromise attacks, and that MFA combined with blocking legacy authentication stops more than 99.9% of common identity attacks. In 2022 Microsoft reported that more than 99.9% of the hacked accounts it saw had no MFA, and that tenants using its free security defaults had 80% less compromise than the overall tenant population.
These are vendor figures based on Microsoft's own telemetry, so treat them as strong evidence rather than a guarantee. They measure common attacks such as password spraying and credential stuffing, which make up most of the volume. Targeted attacks on a specific person are harder to stop, as the bypass data below shows, but the baseline benefit for a small company is large and the cost is close to zero.
Why passwords alone keep failing
Verizon's 2025 DBIR analysed 12,195 confirmed breaches. Use of stolen credentials was the initial access vector in 22% of them, down from 31% the year before but still the most common route. In the Basic Web Application Attacks pattern, about 88% of breaches involved stolen credentials. The report also notes that the lack of mandatory MFA contributed to the Snowflake-related breaches.
Infostealer malware makes the problem worse. Verizon found that about 30% of compromised systems in infostealer logs were enterprise-licensed devices, and that 46% of systems holding corporate logins were unmanaged devices with both personal and business credentials. Among ransomware victims, 54% had their domains appear in credential dumps. A password that has been stolen once can be replayed anywhere it was reused.
Not all MFA is equal
Any second factor is better than none, but methods differ in how well they resist phishing. Codes sent by SMS or voice can be intercepted or phished, and Microsoft is retiring its native SMS and voice delivery for Entra ID on 1 February 2027. Push approvals are better when they use number matching, which Microsoft's security defaults now require to reduce MFA fatigue attacks.
Passkeys and FIDO2 security keys are phishing resistant because the browser only releases the credential to the genuine site. Microsoft recommends FIDO2 keys or Authenticator passkeys for privileged users and regulated environments, and Google lists security keys among the methods admins can require. Use them first for administrators, finance and anyone who can approve payments.
| Method | Phishing resistance | Notes for small teams |
|---|---|---|
| SMS or voice code | Low | Microsoft retires native SMS and voice delivery for Entra on 1 February 2027 |
| Authenticator app code | Medium | Free, works offline, can still be phished on a fake page |
| Push with number matching | Medium | Required by Microsoft security defaults to curb fatigue attacks |
| Passkey on phone or laptop | High | Default sign-in method rolling out in Entra ID from 1 September 2026 |
| FIDO2 hardware security key | High | Recommended by Microsoft for privileged users |
How attackers get around MFA
Verizon studied 2,102 Microsoft 365 MFA bypass attacks in its 2025 report. Token theft, where malware or a proxy steals the session cookie after a valid sign-in, was the most common technique at 31%, followed by MFA interrupt and adversary-in-the-middle attacks. Suspicious logins appeared in almost 40% of the attacks. MFA prompt bombing, which floods a user with approval requests, was tied to a few large state-sponsored campaigns.
Generative AI is making the phishing step more convincing. Microsoft cites threat research in which AI-enabled phishing reached click-through rates of up to 54%, against about 12% for traditional campaigns. The defences are phishing-resistant methods, number matching on push, short session lifetimes for admins, and device checks so that a stolen token is useless on an unknown machine.
Where the platforms are heading
The large platforms have stopped leaving MFA optional for admins. Microsoft has enforced MFA in the Azure portal, Entra admin center and Intune admin center since October 2024, and in the Microsoft 365 admin center from February 2025. Google is rolling out compulsory 2-Step Verification for all Workspace administrators, with about 90 days' notice for super admins and loss of web app access 30 days after enforcement if they have not enrolled.
Passkeys are the next step. Entra ID began making passkeys the default sign-in method from 1 September 2026, and in July 2026 Google added FIDO2 keys and phone passkeys as a second factor at the Windows sign-in screen through its credential provider. A FIDO Alliance and HID survey found 93% of organisations at some stage of passkey adoption but only 13% with passkeys deployed at scale.
A rollout plan for a small team
Start with administrators, then people who handle money or employee data, as Google's small business checklist suggests, then everyone else. Before enforcing, let users enrol, check the enrolment report and give each person two methods, such as a passkey and an authenticator app, so a lost phone is not a lock-out. Print backup codes for admins and store them offline, and create a second admin account in case one is lost.
Block legacy protocols such as IMAP and POP3, which cannot do MFA, and enforce by group so problems stay contained. Tell staff that an unexpected approval request means someone has their password and must be reported, not approved. Review sign-in logs for failed MFA attempts. XDQ Labs helps small teams plan and test MFA rollouts on their own systems.
- Admins first, then finance and HR, then everyone
- Two registered methods per person
- Backup codes for admins, kept offline
- Legacy authentication blocked
- Clear rule: never approve a prompt you did not start
The cost of getting it wrong
IBM's 2025 study puts the average cost of a data breach in India at ₹22 crore, with phishing the most common initial vector at 18%. Verizon found ransomware in 88% of breaches at small and medium businesses, and 54% of ransomware victims had their domains in credential dumps. Against those numbers, MFA is one of the few controls that is close to free and quick to deploy.
The practical conclusion from the data is simple. Turn on MFA for every account now, using whatever method your team can adopt fastest, then move admins and finance staff to passkeys or security keys. Pair it with device management and short admin sessions so that the remaining bypass techniques, mainly token theft, have less to work with.
Frequently asked questions
Is SMS-based MFA better than no MFA?
Yes. Any second factor raises the bar for attackers, and Microsoft says MFA in general blocks more than 99.2% of account compromise attacks. SMS is the weakest option because codes can be phished or intercepted, and Microsoft retires native SMS delivery for Entra on 1 February 2027, so plan to move to an app or passkeys.
Can attackers bypass multi-factor authentication?
Yes, in targeted attacks. In Verizon's study of 2,102 Microsoft 365 MFA bypass attacks, token theft was the most common technique at 31%, followed by MFA interrupt and adversary-in-the-middle phishing. Phishing-resistant methods such as passkeys, number matching and device checks reduce these risks considerably.
What is phishing-resistant MFA?
Phishing-resistant MFA uses passkeys or FIDO2 security keys that only release a credential to the genuine website, so a fake login page gets nothing usable. Microsoft recommends FIDO2 keys or Authenticator passkeys for privileged users, and Google lets Workspace admins require security keys for 2-Step Verification.
Is MFA free in Microsoft 365 and Google Workspace?
Yes. Microsoft's security defaults, which require MFA for all users, need no extra licence. Google lists 2-Step Verification on every Workspace edition, including Business Starter. You only pay extra for advanced controls such as Conditional Access, which needs Microsoft Entra ID P1, or for hardware security keys.
Sources
- Planning for mandatory multifactor authentication for Azure and other admin portals, Microsoft Learn, 2026
- Security defaults in Microsoft Entra ID, Microsoft Learn, 2026
- Raising the baseline security of all organizations in the world, Microsoft Tech Community, 2022
- 2025 Data Breach Investigations Report (full report), Verizon Business, 2025
- 2025 Data Breach Investigations Report news release, Verizon, 2025
- Microsoft and Google push passkeys deeper into workplace authentication, Biometric Update, 2026
- About 2SV enforcement for admins, Google Workspace Admin Help, 2026
- Google adds FIDO2 keys and phone passkeys to Windows login via GCPW, Help Net Security, 2026
- India Records Highest Average Cost of a Data Breach: IBM Cost of a Data Breach Report 2025, IBM India Newsroom, 2025
- Security checklist for small businesses (1 to 100 users), Google Workspace Admin Help, 2026
