What It Actually Means
The password is the first. The second is a code from an app, a tap on a phone, or a physical key. The point is that the two are independent, so stealing one does not deliver the other.
This matters because passwords fail as a category, not individually. People reuse them, and the reused password reaches an attacker through a breach at a completely unrelated service. No amount of password complexity protects against that. A second factor does.
Why It Is Worth More Than Anything Else You Could Buy
For a business of almost any size, turning on 2FA across email, banking, hosting and any system holding customer data removes more realistic risk than every other security measure combined, and it costs nothing.
That is an unusual ratio and it is worth acting on before anything more sophisticated is considered. The overwhelming majority of small-business compromises begin with a working username and password, obtained without any attack on you at all.
Not All Second Factors Are Equal
They are usually presented as one feature. They are not.
SMS codes are the weakest and the most common. They can be intercepted, and more practically, a phone number can be moved to another SIM by someone who convinces a mobile provider they are you. Still far better than nothing, and the first thing to upgrade if the account matters.
Authenticator apps generate codes on the device itself with nothing to intercept. This is the sensible default for almost everything.
Push approvals are convenient and introduce their own failure: people approve prompts without reading them, and attackers exploit that by sending repeated requests until someone taps accept to stop the noise. Worth knowing if your team uses them.
Hardware keys are the strongest, because the key checks the site is genuine before responding. This defeats phishing outright rather than making it harder, and it is worth the cost for the accounts that control everything else: the domain, the email admin, the hosting.
What To Ask
- Which accounts control the others? Email first, always. Whoever holds the email can reset most other passwords.
- What happens when someone loses their phone? Recovery codes need to exist and be stored somewhere sensible before they are needed.
- Do shared accounts exist? They break 2FA, and they are usually where it quietly gets disabled.
- Is it enforced or optional? Optional means partial, and partial means the weakest account is the real security level.
The Thing That Undermines It
Recovery routes. An account with strong 2FA and a password reset that only needs an email address is protected exactly as well as that email address.
This is where the ordering matters. Securing the email account properly, then working outwards, is the only sequence that holds. Doing it in the other order produces the appearance of security across a dozen systems while the master key sits behind a password from 2019.
Shared credentials are the other common gap, and they usually mean 2FA has been switched off so the team can get in. That is a real operational problem with a real answer: a password management system gives individual access to shared resources, so the second factor stays on and access can be removed when somebody leaves.
More terms are in the glossary.
