What it is
MFA means a password is not enough. Sign-in also requires something you have (a phone prompt, a hardware key) or something you are (a biometric). It is the single cheapest control that stops most stolen-password attacks.
ExampleWhat it looks like
A phished Microsoft 365 password is useless if the attacker also has to approve a prompt on the employee's phone, and you have blocked the weaker "approve any number" prompts.
WolfTech
How we handle it
WolfTech turns MFA on for Microsoft 365, VPN, and admin tools as a default, not an upgrade. If a client is still password-only, that is the first fix.
