Ask a security engineer what one control they'd deploy first in a small business, and the answer is boring and unanimous: multifactor authentication, on everything, for everyone.
The reason is how compromises actually happen. Attackers rarely need sophistication when a password — phished, reused from a breached site, or simply guessed — opens the door. MFA means a stolen password alone is no longer enough.
"Everywhere" is the hard part
Most organizations we review have MFA somewhere — typically on email for most users. The gaps are where incidents start: the shared mailbox nobody thought about, the finance application outside single sign-on, the VPN, the remote-access tool an old vendor installed, and — most dangerously — administrator accounts that predate the policy.
An honest MFA project is therefore an inventory project first: every account that can touch company data or money, every system that authenticates, every exception with a name attached and an expiration date.
Doing it without a mutiny
MFA fails when it's deployed as friction with no explanation. It succeeds when the rollout uses app-based prompts or security keys instead of SMS where possible, enrolls people in waves with real communication, and pairs enforcement with conditional-access policies so users aren't challenged pointlessly on trusted devices.
Done well, most users see a prompt only when something about a sign-in is genuinely unusual — which is exactly the moment you want a human in the loop.