Multi-factor authentication: Why a password alone is no longer enough

In most cases today, cyber attacks begin with compromised user accounts. Phishing, credential stuffing or social engineering make classic password mechanisms one of the biggest security risks in companies. Multi-factor authentication (MFA) supplements the password with an additional security factor, such as app confirmation, biometric features or hardware tokens, thus significantly reducing the risk of unauthorised access. At the same time, regulatory requirements for identity and access protection are increasing. Whether ISO 27001, industry-specific standards or specifications such as NIS2, the protection of user accounts and privileged access is now a key requirement for compliance, auditability and business resilience. The white paper sheds light on how modern MFA concepts can be implemented sensibly, the differences between various authentication methods and how security and user-friendliness can be harmonised. In addition, we show which typical mistakes occur in practice, such as insufficiently secured administrator accounts, missing conditional access rules or inconsistent rollout strategies, and how companies can build a holistic identity strategy. The aim is to understand MFA not as an isolated technical measure, but as an integral part of a modern zero trust architecture.