Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
Multi-factor authentication (MFA) is the highest-impact security control a Canadian SMB can deploy this quarter. Microsoft Research measured it directly across Azure Active Directory: MFA cut the risk of account compromise by 99.22% across the full population studied, and by 98.56% on accounts whose passwords had already leaked.
Most 2026 Canadian cyber-insurance policies require MFA on email and VPN, plus every admin account, as a baseline coverage condition. For a tailored gap map, book an MFA readiness consultation.
Fusion Computing has deployed and managed MFA for Canadian businesses since 2012. I run that practice from our Dundas office with a CISSP-led team and a 1-hour priority response on P1 issues; managed IT engagements start at CA$180+ per user per month.
KEY TAKEAWAYS
- MFA cut account-compromise risk by 99.22%, and by 98.56% on accounts with previously breached passwords (Microsoft Research, 2023).
- SMS is the weakest method: NIST SP 800-63B-4 classes telephone-network one-time codes as a restricted authenticator.
- FIDO2 keys and passkeys are phishing-resistant. Synced passkeys are permitted to AAL2; only device-bound keys reach AAL3.
- Verizon’s 2026 DBIR puts software-vulnerability exploitation at 31% of breaches, ahead of credential theft for the first time.
- MFA is mandatory on virtually every 2026 Canadian cyber-insurance renewal.
- Roughly 6 in 10 tenants Fusion Computing onboards arrive with an unprotected admin console; the five-phase fix lands in about six weeks.
Book an MFA Readiness Consultation
The anonymized client data I keep from those onboardings is blunt. Of the 60+ Canadian SMB tenants Fusion Computing has taken over since 2022, roughly 6 in 10 arrived with at least one Global Admin console that had no MFA enforced. About 1 in 4 had MFA on the mailbox but nowhere else.
What is multi-factor authentication (MFA)?
According to Microsoft Research (2023), multi-factor authentication reduced the risk of account compromise by 99.22% across the full Azure Active Directory population studied, and by 98.56% on accounts whose credentials had already leaked. More than 99.99% of MFA-enabled accounts stayed secure through the study window. That is why MFA is the first control a 10 to 150 person Canadian firm should turn on.
Multi-factor authentication is a security control that requires 2 or more independent verification factors before granting access to an account. The three categories are something you know (password, PIN), something you have (authenticator app, security key), and something you are (fingerprint, face). Real strength comes from combining factors of different kinds so a compromised password alone never logs an attacker in.
A finance or admin login with no MFA showed up in 54% of the environments we audited through Q1 2026. It sits alongside nine other recurring failures in our guide to the most common IT problems in business.
2FA is MFA with exactly two factors. A password plus a security question is single-factor (both are knowledge). A password plus an authenticator-app code is true two-factor; adding a biometric makes it 3.
The strongest configurations bind the second factor to the web origin, so a phished code cannot be replayed. That binding is the line between regular MFA and phishing-resistant MFA.
MFA also decides how bad a compromise gets once a password leaks. If an account has already been taken over, work the 6-step sequence in our guide to what to do if you’ve been hacked or scammed before you change anything else.
How does MFA actually work?
NIST SP 800-63B (Revision 4, 2025) defines the three factor types and grades every combination into Authentication Assurance Levels: synced passkeys reach AAL2 and device-bound passkeys reach AAL3, the highest level in the standard. Grading each account against those levels tells a Canadian SMB exactly which logins are underprotected and which methods close the gap.
MFA works by requiring proof from at least 2 of the 3 factor categories. Those are knowledge (a password or PIN), possession (an authenticator app, FIDO2 hardware key, or trusted workstation), and inherence (a fingerprint, face, or other biometric). The identity provider validates the password first, then challenges the user for the second factor. Only after both succeed is a session token issued.
- Knowledge: password, PIN, security question, recovery phrase.
- Possession: Microsoft Authenticator, Google Authenticator, Duo, FIDO2 security keys (YubiKey, Feitian), smart card, registered laptop.
- Inherence: fingerprint, face recognition, voice, iris.
In Entra ID the flow is: credentials submitted, Conditional Access evaluated, configured Authentication Strength enforced (for example, “phishing-resistant MFA” for admin and finance), user satisfies it with an approved method. If method or context fails the policy, the login is blocked or stepped up.
What are the main benefits of MFA for business?
Statistics Canada (2024 release) reports that 16% of Canadian businesses were hit by a cybersecurity incident in 2023, and that recovery spending doubled from roughly CA$600 million in 2021 to CA$1.2 billion in 2023. Identity theft rose 11 points among impacted firms, which puts authentication squarely at the centre of the damage.
MFA delivers measurable wins on five fronts. It cuts account-compromise risk by 99.22% (Microsoft Research), lowers the recovery spending a breach triggers, satisfies insurance underwriting, meets the PIPEDA reasonable-safeguards expectation, and trims credential-stuffing tickets. It typically pays for itself in 90 days.
The threat model moved in 2026, and honest MFA advice has to move with it. Verizon’s 2026 DBIR reports that 31% of breaches now start with software vulnerabilities, beating stolen passwords as the top way attackers get in, with credential theft down to 13%. MFA still closes the credential door. Patching closes the other one, and I now scope them as one program rather than a ranking.
MFA methods comparison: SMS, authenticator app, FIDO2, passkey
According to the FIDO Alliance, passkeys are supported in all major operating systems, internet browsers, and third-party passkey providers, and its 2024 survey found 53% of people had enabled a passkey on at least one account. That breadth makes phishing-resistant login practical company-wide. Method choice still matters: an SMS code and a device-bound passkey sit at opposite ends of the SP 800-63B-4 scale.
From strongest to weakest: passkeys and FIDO2 security keys (phishing-resistant by cryptographic design), authenticator-app TOTP codes, push with number-matching, biometrics on managed devices, and SMS or email codes (vulnerable to SIM swap and mailbox theft). Federal guidance recommends authenticator apps or hardware keys for any business account that handles sensitive data.
NIST SP 800-63B-4 goes further on SMS. It treats one-time codes sent over the public telephone network as a restricted authenticator: still permitted, but the verifier has to make an unrestricted alternative available and warn users about the risk.
For a side-by-side, see FIDO2 keys vs passkeys for Canadian business. The starting mix I default to for most SMBs: authenticator-app TOTP for general staff and FIDO2 keys (YubiKey, Feitian) for admins and finance. Passkeys come in the second wave. In our practice that split keeps enrolment friction manageable for a 25 to 150 person firm.
Phishing-resistant MFA: CISA and NIST SP 800-63B requirements
According to CISA’s Implementing Phishing-Resistant MFA fact sheet (2022), phishing-resistant MFA is the gold standard and organizations should treat migrating to it as a high-priority effort, starting with system administrators and other high-value targets. CISA also names the fallback for smaller firms: app or token-based one-time codes, or mobile push with number matching.
The guidance is unambiguous: prefer phishing-resistant MFA (FIDO2 / WebAuthn security keys and passkeys) wherever the application supports it. NIST SP 800-63B-4 backs this up. Syncable passkeys are barred from AAL3 because the private key is exportable, so device-bound hardware keys are the only route to the top tier, and phishing resistance is mandatory there.
Regular MFA falls to the adversary-in-the-middle (AiTM) phishing kits behind the 100+ campaigns the Cyber Centre has tracked: they proxy the real sign-in page and steal the session token. FIDO2 and passkeys defeat this because the cryptographic challenge is tied to the genuine domain and will not authenticate against a look-alike.
Where to start, in the order I use: Microsoft 365 admins, finance systems, and VPN endpoints get FIDO2 keys first. Everyone else gets authenticator-app TOTP, with passkeys in the second wave. Pair the identity rollout with Teams security best practices so Conditional Access covers Teams sessions, not just the inbox.
“I budgeted two weeks of complaints when we turned MFA on for all 62 staff. We logged 3 helpdesk tickets in the first week, and our insurance renewal that fall was the first one in 3 years without a follow-up questionnaire.”
Book an MFA Readiness Consultation
CISSP-led rollouts since 2012. 4.9★ across 48 verified Google reviews.
Why is MFA mandatory for Canadian cyber insurance in 2026?
Canadian insurers were the first market to make MFA an explicit coverage condition. By the 2026 renewal cycle, MFA on email, VPN, and admin accounts sits alongside endpoint detection and a tested incident response plan as a baseline requirement. Several carriers deny claims when MFA was absent at the time of compromise. PIPEDA’s reasonable-safeguards standard points the same direction for any account that touches personal information.
Underwriting questionnaires ask specifics: Are Conditional Access policies enforced? Is number matching enabled on approvals? Are hardware keys required on privileged accounts? “We have MFA” is no longer enough.
How do you roll out MFA across a Canadian SMB?
According to the Cyber Centre’s ITSAP.00.105 (2023), a phased rollout should enforce MFA first on the accounts that are high-value targets, which it defines as administrative accounts and the email accounts of senior management. That order matches what a 25 to 150 person rollout needs in practice: protect the accounts that can burn the tenant down, then widen enforcement in planned waves.
A phased rollout wins buy-in and keeps the helpdesk from drowning. Across Fusion Computing’s Canadian SMB MFA deployments through Q1 2026, the same five-phase plan lands in roughly six weeks: admin-first, pilot, all-user with authenticator default, eliminate SMS, then tune Conditional Access quarterly.
We benchmarked the sequence across our managed tenants: the median I see is six weeks end to end for a 25 to 150 person firm (FC internal benchmark from Q1 2026). The longest phase is never the technology. Phase 3 training and phase 4 SMS elimination consume roughly 60% of the calendar.
Recovery codes belong in the project scope from day 1: each user generates a one-time code at enrollment, stored in a vault that IT support can use to get users back in without bypassing policy. I make clients practise the flow in week 2; my rule is the vault gets tested the same day it’s filled.
Common MFA bypass techniques and the defence each one requires
The Cyber Centre’s ITSM.30.031 reports more than 100 credential-relay phishing campaigns targeting Microsoft Entra ID accounts between 2023 and early 2025. The same publication names phishing-resistant MFA as the best defence. Bypass techniques target the weakest enrolled method on an account, so the defence work is method hygiene rather than more prompts.
4 attack classes account for almost every modern MFA bypass: SIM-swap on SMS, push-bombing, AiTM session-token theft, and support-desk social engineering. Each has a known mitigation; together they shrink the exposed surface to a small residual.
- SIM swap: the phone number gets ported and SMS codes intercepted. Fix: eliminate SMS at tenant level, use authenticator apps or FIDO2.
- MFA fatigue: attacker spams approval prompts until the user taps Approve. Mitigation: require the typed number on approvals, 1-3 attempt cap, lock on excess, train users that an approval they did not request is evidence of an attack in progress.
- AiTM session theft: phishing kit proxies the real sign-in page and captures the issued token. Defense: phishing-resistant MFA (FIDO2 / passkeys) on targeted accounts plus risk-based Conditional Access.
- Recovery flow abuse: someone calls the helpdesk impersonating a locked-out user. Countermeasure: documented identity-verification script, callback, two independent proofs before re-enrollment.
In our practice, across Fusion Computing’s 60+ Canadian SMB tenants since 2022, I have not seen a single successful MFA-fatigue compromise under my standard configuration. That configuration means number-matching push, a three-prompt cap, geofenced Conditional Access, and SMS disabled at the tenant level. If your tenant is not set up that way yet, book an MFA readiness consultation and we will map the gaps.
Free download
The Network Security Controls Checklist (2026)
The identity and access section turns this article into yes/no controls you can audit: MFA status by account type, admin console protection, Conditional Access, and backup codes. Built by our CISSP-led team, mapped to the CCCS control set across 6 domains, with a scoring guide.
No sales call required. Want the answers verified against your environment? Book an MFA readiness consultation.
Frequently asked questions
What is the difference between MFA and 2FA?
2FA uses exactly two factors. MFA is the broader category that allows two, three, or more. For most Canadian SMBs, 2FA with a password plus an authenticator app is the baseline; three-factor matters for privileged accounts.
Is SMS-based MFA still secure for business in 2026?
SMS is the weakest mainstream method. SIM-swap attacks let an attacker port a number, and SMS is unencrypted across carrier networks. NIST SP 800-63B-4, finalised in 2025, classes telephone-network one-time codes as a restricted authenticator, permitted only alongside an unrestricted alternative. Treat SMS as a last-resort fallback, never for admin or finance accounts.
What if an employee loses the phone with their authenticator app?
Recovery codes solve this. During setup every user generates one-time codes (most platforms issue 8 or 10), stored in a vault accessible to IT. If the device is lost, the IT team validates identity through a separate channel and consumes one code so the user can add a new authenticator app.
How do you stop MFA fatigue attacks?
Enable number matching so users must type a code rather than tap Approve. Cap attempts at 1-3 per session and lock on excess. Deploy Conditional Access that blocks unfamiliar geographies and untrusted devices. Train users that an unexpected prompt is an attack signal.
Is MFA required by Canadian law?
No Canadian statute names MFA. PIPEDA does not, and Ontario’s PHIPA does not either: section 12(1) requires steps that are reasonable in the circumstances, which is the hook regulators use. The Office of the Privacy Commissioner treats MFA as a baseline safeguard for accounts touching personal information, and Quebec’s Law 25 and PCI-DSS point the same way. Practically, yes for any account handling personal or financial data.
Does cyber insurance require MFA in 2026?
Yes. On virtually every 2026 Canadian carrier renewal, MFA on email, VPN, and admin accounts is a standard coverage condition. Several carriers deny claims when MFA was absent at compromise. Underwriting now asks for Conditional Access detail and phishing-resistant methods on privileged accounts.
Are passkeys ready for SMB use?
Yes. The FIDO Alliance reports passkey support in all major operating systems, browsers, and third-party passkey providers. NIST SP 800-63B-4 permits syncable passkeys to AAL2 but bars them from AAL3 because the private key is exportable, so device-bound keys carry the top tier. For legacy SaaS without FIDO2, authenticator-app TOTP is the bridge.
Do hardware keys make sense for a 25-person company?
For admin and finance roles, yes. A YubiKey 5 runs roughly CA$70. One key per admin and finance user is a small line item against a single business email compromise. The Canadian Anti-Fraud Centre logged CA$704 million lost to fraud in 2025, and CA$351 million in the first half of 2026 alone.
PHIPA itself never names multi-factor authentication, which surprises most clinic owners. Our guide to managed IT services for healthcare providers sets out where the duty actually comes from.
MFA closes the mailbox door and leaves the payment door open. See wire fraud and business email compromise for the callback rule that covers the second one.
Related Resources
Fusion Computing serves Canadian businesses across:
