Passwords are still the front door
Most accounts in a growing company are protected by a password and, too often, nothing else. When people reuse a password that leaked from another site, or type it into a convincing fake login page, the attacker walks in with valid credentials. No malware needed, and nothing looks unusual at first.
The fix is well understood and not expensive: a password manager so every password is unique, and multi-factor authentication so a stolen password alone isn’t enough.
What we deploy and manage
- A business password manager. We recommend and roll out a team password manager, such as 1Password or Bitwarden, with company-owned vaults and policies.
- Secure sharing. Shared accounts live in team vaults with access by role, instead of in chat messages and spreadsheets.
- Enforced MFA. Multi-factor authentication turned on and enforced for email, the password manager, cloud apps and admin accounts, moving toward phishing-resistant methods such as passkeys and security keys.
- Single sign-on where it fits. Connecting apps to one identity provider means one place to enforce MFA and one switch to turn off access.
- Onboarding and offboarding. New starters get the right vaults on day one; leavers lose access in one step, and shared credentials are rotated.
- Breach monitoring. Alerts when company credentials appear in known breaches, so they can be changed before they’re used.
MFA methods, strongest to weakest
| Method | Phishing resistance | Notes |
|---|---|---|
| Passkeys and hardware security keys | High | Tied to the real site, so fake pages can’t capture them |
| Authenticator app with number matching | Medium | Good default; number matching blocks push fatigue attacks |
| Authenticator app codes | Medium | Can be phished by real-time fake pages |
| SMS codes | Low | Vulnerable to SIM swapping; use only as a fallback |
Rollout without the pushback
Pick the tool
We recommend a password manager based on your size, budget and existing identity setup.
Admin and policy setup
Vaults, sharing rules, password policies and recovery options configured before anyone is invited.
Team rollout
Short onboarding for staff, importing existing passwords and moving shared accounts into team vaults.
MFA everywhere
MFA enforced app by app, starting with email and admin accounts, then everything else.
Part of a bigger identity picture
Strong passwords and MFA are the base layer of zero trust access. They’re also the reason security awareness training can focus on judgment instead of password rules.