Episode 03

MFA

Most people think MFA means “that annoying OTP”. That’s not quite right.

At its core, MFA is about verifying at least two of three things: something you know (passwords, PINs, passphrases), something you have (your phone, a hardware token, an authenticator app), and something you are (fingerprint, face scan, biometrics).

If two or more are required, you’re no longer relying on a single point of failure.

2FA or MFA

People get confused here. 2FA is exactly two factors. MFA is two or more. In practice they’re used interchangeably, and the idea is the same: one factor is never enough any more.

Scenario

You’re working from a café. Someone guesses or steals your password. Maybe you typed it on public Wi-Fi. Maybe it was reused from another site.

Without MFA they log into your email, reset Slack, get into Jira, find production clues, and move laterally. This is how real breaches happen. Fast, quietly, often in minutes.

With MFA they enter the password, the prompt shows up, and they don’t have your phone or your biometric. End of story. One leaked password becomes useless.

Why it matters for leaders

MFA isn’t about OTPs. It’s about shrinking your surface area of attack. That’s why security frameworks treat it as basic hygiene rather than an advanced control.