Multi-factor authentication (MFA) is one of the single most effective controls you can add to any account. Even if a password is stolen, MFA usually stops the attacker cold.\n\n## Why passwords alone aren't enough\n\nPasswords get reused, guessed, and leaked in breaches constantly. A password is something you know — and things you know can be copied without you ever finding out.\n\n## What MFA actually adds\n\n- Something you have — a phone, a security key, an authenticator app\n- Something you are — fingerprint or face recognition\n- A time-limited code that expires in seconds\n\n> If you only do one security thing this month, turn on MFA for your email account. Email is the master key to almost everything else.\n\n## Getting started\n\n1. Open your account's security settings\n2. Look for "Two-Factor Authentication" or "Multi-Factor Authentication"\n3. Prefer an authenticator app or hardware key over SMS codes when available\n\nEnabling this takes about five minutes per account and meaningfully raises the bar against credential-based attacks. Learn more in our awareness pillar.
Watch: how MFA stops account takeover in practice
What a login attempt log can tell you
2026-08-20 03:14:02 login_attempt user=jane@company.com ip=203.0.113.44 mfa=false result=SUCCESS
2026-08-20 03:14:55 login_attempt user=jane@company.com ip=198.51.100.9 mfa=false result=SUCCESSTwo successful logins from different IPs within a minute, with MFA disabled, is a pattern worth investigating — this is exactly the kind of signal MFA would have blocked outright.