Why does my IT provider insist on multi-factor authentication (MFA)?

Passwords leak constantly — through phishing, through breaches of other services where employees reused them, through malware. Attackers don't 'hack in' so much as log in. MFA (the extra prompt on your phone) means a stolen password alone is useless, which neutralizes the single most common attack against small businesses.

The pushback is always about convenience, so it's worth being precise: modern MFA adds seconds, not minutes, and only occasionally — trusted devices don't re-prompt constantly. Compare that to the alternative: a compromised email account is used to raid your contacts, reroute invoices, and launch attacks on your customers in your name. The cleanup costs weeks and relationships.

MFA is also increasingly non-optional in a formal sense: cyber-insurance applications ask about it directly, and misrepresenting it can void coverage. If your provider is pushing MFA, that's evidence they're doing their job. If they aren't pushing it, ask why.