Does Every Account Really Need MFA? A Straight Answer for Business Owners
Yes, every interactive user account should use multi-factor authentication whenever the system supports it.
That does not mean every account needs the same authentication method or that every legacy system can be changed overnight. It does mean there is no such thing as an “unimportant” account when that account can provide a path into your business.
An old shared mailbox, a vendor portal, or a billing application may not seem as important as your bank account or Microsoft 365 administrator account. But attackers do not need to start with the most valuable system. They only need one working credential, one overlooked login, or one poorly protected access point.
For business owners, the question is not whether MFA is convenient. It is whether the cost of adding another verification step is smaller than the potential cost of stolen credentials, operational downtime, lost revenue, client notification, reputational damage, or an insurance claim that becomes difficult to defend.
Why the “less important” account can still put the business at risk
Attackers rarely stop after gaining access to one account. They look for ways to expand their reach.
Imagine an employee’s password is stolen through a phishing email. The compromised account may only have access to a shared mailbox. From there, the attacker could find:
- Vendor invoices and payment instructions
- Password-reset messages
- Customer or client information
- Documents containing financial details
- Links to cloud applications
- Conversations with your bank, accountant, or technology provider
The attacker then uses that information to move deeper into the business. This is called lateral movement, but the business impact is easier to understand than the technical term:
One stolen key is used to find and open more doors.
The attacker may reuse the password on another service, impersonate an employee, request access to a file platform, or use a mailbox to send convincing messages to someone in finance. A low-value login becomes the starting point for business email compromise, wire fraud, ransomware, or data theft.
This is why MFA is most effective when it protects the full chain of access, not just the systems leadership considers critical.
The business risk is larger than the technology risk
Small and mid-sized businesses are frequent targets because they often have valuable data without the security staffing and controls of a large enterprise. Verizon’s 2019 Data Breach Investigations Report found that small businesses accounted for 43% of reported breaches. That figure remains a useful reminder that size does not make a company invisible.
B&R Computers also uses several planning benchmarks when helping businesses evaluate exposure:
- A serious breach can create $200,000 or more in total impact when recovery, downtime, legal services, notification, and lost business are considered.
- 60% of businesses are often cited as closing within six months of a significant breach.
- 74% of breaches involve human error or human-related factors, reinforcing the need for controls that protect employees when mistakes happen.
These figures are not a prediction of what every business will lose. They illustrate the potential range of consequences. A breach can affect revenue, customer trust, regulatory obligations, cyber insurance, and the owner’s ability to keep operations running.
IBM and the Ponemon Institute reported a much higher global average breach cost, $4.88 million in their 2024 study, because that figure covers organizations across many industries and sizes. The lesson is not that every SMB will experience a multimillion-dollar event. The lesson is that the financial impact of a breach extends well beyond replacing a password or cleaning up one computer.
If you cannot enable MFA everywhere today, use this rollout order
Most businesses cannot change every system in one afternoon. That is acceptable. Risk management means identifying the highest-impact exposures, addressing them in the right order, and continuing until the gaps are closed.
1. Email and identity accounts
Start with email, Microsoft 365, Google Workspace, and the identity platform that controls access to other systems.
Email is often the master key to the business. It is used for password resets, customer communication, payment approvals, vendor relationships, and internal authorization. Protect every employee, contractor, executive, and administrator account that can sign in.
Do not forget:
- Shared mailbox access
- Former employee accounts
- Temporary or seasonal workers
- Accounts belonging to executives and finance staff
- Administrative identities used to manage email or identity systems
For shared mailboxes, avoid having employees sign in directly with one common password. Each person should use an individual account protected by MFA and receive delegated access to the mailbox. That improves accountability and makes it possible to remove one person’s access without disrupting everyone else.
2. Remote access and VPN
Next, protect every path that allows someone to connect to business systems from outside the office.
This includes VPNs, remote desktop services, virtual desktops, remote management tools, and cloud-based administrative consoles. Remote access is attractive to attackers because it can provide a direct route into internal systems.
MFA should be required before a user can connect. Where available, pair it with device-based rules that allow access only from approved, encrypted, updated, and monitored devices.
3. Financial and banking portals
Protect banking, payroll, payment processing, accounting, tax, and other financial systems.
These accounts directly affect cash flow. A compromised mailbox may create the appearance of a legitimate payment request, but access to a banking or payroll portal can turn that deception into an immediate financial loss.
Use the strongest MFA method the financial institution supports. Separate payment approval from payment creation when possible. Do not allow one compromised user account to initiate and approve a high-value transaction without a second level of verification.
4. Cloud and SaaS administrator accounts
Cloud administrator accounts control users, data, applications, security settings, and recovery options. A compromised administrator may be able to disable security controls, create hidden accounts, access company files, or lock legitimate users out.
Require MFA for administrator accounts and use separate administrative identities rather than giving everyday employee accounts permanent elevated privileges. Phishing-resistant methods, such as security keys or passkeys, are preferable for high-privilege access where the platform supports them.
5. Everything else
Once the highest-risk systems are protected, continue through the rest of the application inventory:
- Customer relationship management systems
- Human resources and benefits platforms
- Vendor portals
- Billing and invoicing tools
- File-sharing platforms
- Industry-specific applications
- Marketing and social media accounts
- E-commerce and customer portals
A vendor portal may not be part of your internal network, but it may still contain client information, financial records, or access to a sensitive business process. Treat third-party systems according to the information and authority they hold, not according to whether they are hosted by someone else.
What about systems that cannot use MFA?
There are legitimate exceptions, but they should be documented and managed, not ignored.
Legacy systems
Some older applications cannot support modern MFA. Do not treat that limitation as a reason to leave the system exposed.
Possible compensating controls include:
- Restricting access to specific devices or locations
- Placing the system behind a VPN or protected gateway
- Limiting which users can access it
- Segmenting it from other business systems
- Replacing it as part of a defined technology plan
- Monitoring logins and unusual activity
A legacy system should have an owner, a documented business purpose, and a plan to reduce or eliminate its risk.
Service accounts
Service accounts run applications, integrations, scheduled jobs, and automated processes. They often cannot complete a traditional MFA prompt because no person is signing in interactively.
Instead, use:
- Long, randomly generated secrets
- Certificate- or key-based authentication
- Secure credential vaulting
- Least-privilege permissions
- Regular secret rotation
- Network restrictions
- Logging and monitoring
A service account should have only the access required for its specific task. It should not be given broad administrator privileges simply because that is easier to configure.
Shared logins
Shared credentials make it difficult to know who accessed a system and make offboarding unreliable. Whenever possible, replace shared logins with individual accounts and delegated permissions.
If a shared login cannot be eliminated immediately, apply device-based restrictions, limit the account’s permissions, rotate the password regularly, and monitor its use. Treat it as a temporary exception with a clear owner and a deadline for improvement.
MFA is a baseline, not the entire security program
MFA significantly reduces the chance that a stolen password will be enough to access a system. It does not eliminate phishing, malware, insider risk, or poor access management.
MFA should work alongside:
- Least-privilege access
- Endpoint protection and monitoring
- Tested backups
- Security awareness training
- Timely patching
- Vendor risk reviews
- Incident response planning
- Conditional access policies
- Regular account reviews
The goal is not to collect security features. The goal is to reduce the likelihood and impact of a business interruption.
Insurance carriers and compliance frameworks increasingly expect MFA for important access. The FTC Safeguards Rule, HIPAA security practices, and PCI DSS requirements all create obligations around protecting sensitive information and controlling access. Requirements vary by business and environment, but a missing MFA program can create difficult questions during an audit or insurance claim.
It is hard to explain why a compromised account had access to sensitive systems without MFA when the control was available and widely accepted as a basic safeguard.
The straight answer
Do you need MFA on every account?
Every human account that can access company email, business systems, cloud services, remote access, vendor portals, or sensitive data should use MFA.
For accounts that cannot support it, document the exception and apply other controls. Protect the highest-risk systems first, but do not stop at email and banking. Attackers look for the gap you considered too small to matter.
B&R Computers helps business owners identify those gaps, quantify their potential impact, and build a prioritized plan to mitigate and monitor them. Start with our cybersecurity and business risk resources, or request a free Business Risk Review / IT Risk Review to understand where your access controls stand today.