Multi-factor authentication

Multi-factor authentication requires more than one kind of proof to sign in: something you know (a password) plus something you have (a phone, an app, a hardware key) or something you are (a fingerprint).

It is the single most effective control against account takeover, because it makes a stolen password insufficient on its own. Given the reality of reused passwords, that covers the overwhelming majority of real-world compromises.

The factors are not equal. Codes sent by SMS are far better than nothing and are defeated by SIM swapping; an authenticator app is stronger; a hardware security key resists phishing outright, because it will not authenticate to a lookalike domain. Administrative accounts deserve the strongest option available.