Microsoft's own data shows that multi-factor authentication prevents 99.9% of automated account attacks. It's free with Microsoft 365. It takes an hour to deploy. And a significant number of New Zealand businesses still haven't turned it on.
In 2023, CERT NZ's annual report listed compromised credentials as the number one cause of cyber incidents affecting New Zealand organisations. Password attacks — credential stuffing, password spraying, phishing-captured passwords — were the entry point for the majority of account takeovers. Every single one of them would have been stopped by MFA.
What Multi-Factor Authentication Is
Multi-factor authentication requires a second proof of identity beyond a password. The most common form is an authenticator app (Microsoft Authenticator, Google Authenticator) that generates a six-digit code refreshed every 30 seconds. To log in, you need both your password and the current code from your phone. Even if an attacker has your password — whether stolen from a data breach, guessed, or captured in a phishing attack — they can't log in without the second factor.
Why NZ Businesses Don't Have It
The common objections are: "It's inconvenient." "Our staff won't accept it." "We're too small to be targeted." Each of these deserves a direct response.
It's inconvenient: Microsoft Authenticator supports a "number matching" push notification — you tap a number shown on your screen in the app on your phone. The additional login time is three to five seconds. That's the inconvenience. The alternative is a compromised account, which costs your business days of remediation time at minimum.
Our staff won't accept it: This is a management decision, not a staff preference. Requiring MFA is no different from requiring that staff lock their computers when they leave their desk. It's a basic security practice. Staff who've worked through a compromised account incident are uniformly enthusiastic about MFA afterwards.
We're too small to be targeted: Credential attacks are automated. Attackers don't manually select targets — they run scripts against lists of email addresses from data breaches, trying common passwords against each one at scale. Business size is irrelevant to an automated attack. What matters is whether your accounts have a second factor an automated script can't provide.
The Specific Attacks MFA Stops
Password spraying: An attacker tries a small number of common passwords against a large number of accounts. Without MFA, a password like "Winter2024!" will open accounts across many organisations. With MFA, a correct password is worthless without the second factor.
Credential stuffing: Billions of email/password combinations from past data breaches are available on criminal markets. Attackers try these against business accounts. Many people reuse passwords — this attack works alarmingly often without MFA. With MFA, a breached password from LinkedIn doesn't open your Microsoft 365 account.
Phished passwords: Staff fall for phishing pages that capture their Microsoft 365 username and password. Without MFA, the attacker now has full account access. With MFA (non-phishable variants like FIDO2 keys), the captured credentials are useless.
What Optimyze Deploys
MFA alone is necessary but not sufficient. Optimyze configures Microsoft Entra ID Conditional Access alongside MFA — adding requirements that sign-ins come from compliant devices and expected locations. A correct password and correct MFA code from an unrecognised device in a foreign country still gets blocked. This combination stops the attacks that bypass basic MFA through adversary-in-the-middle phishing kits like Evilginx.
MFA is the single highest-impact, lowest-cost security control available to NZ businesses. If your organisation doesn't have it deployed for every user today, this is the one thing to fix before anything else.
