Endpoint and Identity

What is MFA (multi-factor authentication)?

MFA (Multi-Factor Authentication) is an identity check that requires two or more proofs to grant access to an account, not just the password. It combines something you know (the password), something you have (your phone, an app, a physical key) and sometimes something you are (biometrics). That way, a stolen password on its own is not enough for an attacker to get in.

Zamak TechnologiesUpdated on July 10, 2026

How MFA works

After you type the password, the system asks for a second proof before granting access. That extra step is what stops most password-based attacks.

You sign in with your password

The first factor, something you know. On its own it is the weakest link: passwords leak, get reused and are guessed.

The system asks for the second proof

A code in an app, a notification to approve, a physical key or your biometrics. The factor the attacker does not have, even with your password.

You confirm on your own device

Approval happens on something you are holding, not with whoever stole the password on the other side of the world.

Access is granted

Only when both proofs match. If the second is missing, the right password does not open the door.

Source: CISA and NIST (authentication guidance).

The forms of second verification, from weakest to strongest

SMS or email code A code sent by message. Better than a password alone, but exposed to SIM swap and interception. It is the entry-level step, not the ideal.
Push approval A tap to approve the sign-in. Convenient, but it needs attention: reflexively approving a request you did not make is the 'MFA fatigue' gap.
Authenticator app A code that changes every 30 seconds, generated on your phone. It does not travel over the network and does not rely on a reflex tap, which makes it safer than both SMS and push.
Security key or biometrics (phishing-resistant) A physical key (FIDO standard) or biometrics tied to the device. This is the strongest form: even a fake site cannot capture and reuse the proof. It is the phishing-resistant MFA that CISA recommends.

Why the password alone no longer protects you

99.9%+

of compromised accounts had no MFA enabled (Microsoft, 2025)

22%

of breaches start with a stolen credential, the number one entry vector (Verizon DBIR 2025)

$ 4.44M

average cost of a data breach (IBM 2025)

The password is the weakest link: it leaks in breaches, gets reused across sites and is guessed. That is why a stolen credential is the number one way in (22%, Verizon DBIR 2025) and why more than 99.9% of compromised accounts had no MFA (Microsoft, 2025). MFA breaks that chain: even with your password, the attacker lacks the second proof. It is one of the cheapest and most effective controls against account takeover. It does not make a company invulnerable (weaker forms can be bypassed), but it removes the easy door, the one automated attacks try first, while a breach still costs an average of $ 4.44 million (IBM 2025).

How to adopt MFA the right way

Turning MFA on already removes most of the account-takeover risk. A few precautions separate real protection from a false sense of security:

MFA on everything that mattersEmail, remote access, financial and administrative systems. The attacker looks for the one account left without it.
Prioritize the most powerful accountsAdministrators and executives are the preferred target: one of those accounts open is worth many.
Prefer the stronger formsAn authenticator app or a physical key over SMS whenever possible. CISA recommends phishing-resistant MFA.
Watch for MFA fatigueApproving a push by reflex opens the door. Train the team never to approve a sign-in they did not request.
MFA does not replace the other layersAdd endpoint defense and email security to MFA. It is an essential layer, not the only one.

In practice

If an employee's password leaked today, would the attacker get in? With MFA set up well, the password alone does not open the door.

How Zamak handles MFA

Zamak Technologies puts a second identity check on every critical account and integrates it with the rest of the defense, from endpoint protection to email security, so a leaked password does not become an open door. A good starting point is the cybersecurity diagnostic, which shows where a company still relies on the password alone. It is part of Cybersecurity in the Zamak Method.

Frequently asked questions about MFA

What is the difference between MFA and 2FA?

2FA (two-factor authentication) is MFA with exactly two factors. MFA is the general term: two or more. In everyday use, asking for a password plus a code is both at once.

Is MFA the same as two-step verification?

Yes, it is the popular name for the same idea: on top of the password, a second proof. Banks and services often call it 'two-step verification'.

Can MFA be bypassed?

The weaker forms can: an SMS code suffers from SIM swap, and a push can be approved by mistake ('MFA fatigue'). That is why CISA recommends phishing-resistant forms, like a physical key and biometrics. Even so, any MFA is far better than the password alone.

Does MFA get in the way of the team's day?

The impact is small: a tap on the phone at sign-in, or less, with options that remember trusted devices. It is incomparably smaller than the disruption of a hijacked account.

If I have MFA, do I still need a strong password?

Yes. MFA is the safety net when the password fails, not a license for weak passwords. Both layers together, plus a password manager, is the recommended standard.

Does a small company need MFA?

Yes, and it is one of the best value-for-money protections. Password attacks are automated and do not pick by size. Turning MFA on for email and remote access removes the most common way in.