When people imagine a cyberattack on a small business, they tend to picture something technical — a hacker writing code, exploiting obscure software vulnerabilities, defeating firewalls. The reality of how most small business breaches actually happen is far more mundane: someone enters a username and password that works, and then they are in.
Credential-based attacks — password spraying, credential stuffing, phishing for login credentials, purchasing leaked passwords from dark web marketplaces — now account for the majority of initial access events in small and mid-sized business breaches. The sophistication required is low. The automation tools available to attackers are extensive. And the target environment at most small businesses — accounts with weak passwords, shared credentials, no multi-factor authentication, legacy protocols still enabled — is more permissive than most business owners realize.
The good news is that identity hardening is one of the highest-leverage security investments available to a small business. A focused set of changes to how your organization manages credentials and authentication can close the most commonly exploited gaps without requiring significant technology investment.
Why credential attacks have become the dominant entry point
Attackers follow the path of least resistance, and for the past several years that path has run directly through credentials. Several forces have made this worse in 2026:
Data breach databases have grown to an unprecedented scale. Billions of username-and-password combinations from prior breaches are freely available in underground markets and searchable databases. Credential stuffing — the automated process of testing those leaked combinations against new targets — is now trivially easy to execute at scale. If any of your employees have ever reused a password from a breached service on a business account, that combination has likely already been tested against your login portals.
Phishing has become harder to detect. AI-assisted phishing campaigns can now produce highly personalized, contextually accurate messages at volume. Employees who would easily spot a generic "verify your account" email are increasingly fooled by messages that reference real colleagues, real projects, and real business contexts — because attackers can generate those details from LinkedIn, company websites, and prior communications.
Legacy authentication protocols remain enabled in many Microsoft 365 and cloud environments even when organizations believe they have enforced MFA. Protocols like IMAP, POP3, and basic authentication bypass modern authentication entirely, meaning an attacker with a valid password can authenticate directly to email without triggering any MFA prompt. Disabling these protocols is one of the most impactful single changes a Microsoft 365 environment can make, and it is frequently overlooked.
The identity hardening checklist: what to fix first
Identity hardening does not require enterprise tooling. For small businesses on Microsoft 365 or Google Workspace, the following changes are available within your existing platform and can be implemented in order of impact:
1. Enforce MFA on every account — no exceptions. Multi-factor authentication is the single most effective control against credential-based attacks. An attacker with a valid password cannot authenticate if MFA is required and the legitimate account holder has not approved the request. Microsoft research has consistently found that MFA blocks over 99% of account compromise attempts that use stolen passwords. "Every account" means every account — including executives, who are frequently targeted specifically because they often have the most permissive access and the least oversight.
2. Disable legacy authentication protocols. In Microsoft 365, go to Azure Active Directory (Entra ID) and create a Conditional Access policy that blocks legacy authentication for all users. This closes the MFA bypass that legacy protocols enable. If your organization uses any applications that require basic auth, identify them first and find modern authentication alternatives — but do not leave legacy auth enabled for the whole tenant to accommodate one legacy app.
3. Eliminate shared accounts. Every employee should have their own individual account for every system they access. Shared accounts — a generic "info@" mailbox that five people know the password to, a shared admin account for a vendor portal — make it impossible to attribute actions, impossible to revoke access cleanly when someone leaves, and impossible to apply MFA meaningfully. Audit every shared account in your environment and convert them to individual accounts with appropriate delegation where email access is needed.
4. Deploy a business password manager. If employees are creating their own passwords without guidance, some percentage of those passwords are weak, reused from personal accounts, or stored insecurely. A business-grade password manager (Microsoft Entra ID built-in, Bitwarden Teams, 1Password Business, or similar) generates strong unique passwords for every account, stores them securely, and makes it practical for employees to use credentials they could not memorize — which is exactly the point. Requiring a password manager is a policy decision as much as a technology one, and it should be paired with a written password policy.
5. Check for breached credentials in your domain. Microsoft Entra ID Password Protection and third-party services like Have I Been Pwned for Domains can alert you when credentials associated with your email domain appear in breach databases. This is intelligence you want before an attacker acts on it. If you discover that employee credentials have been exposed, require immediate password resets for those accounts — and investigate whether any unauthorized access occurred in the period since the breach.
6. Enable sign-in risk policies. Microsoft Entra ID includes risk-based Conditional Access — the ability to automatically require step-up authentication or block sign-ins that appear anomalous based on location, device, IP reputation, and behavioral signals. Enabling these policies means that even if an attacker has valid credentials, a sign-in attempt from an unfamiliar country at 3am from a known malicious IP will be flagged and challenged automatically.
7. Review and restrict privileged access. Global Administrator and other highly privileged roles in Microsoft 365 should be held by as few accounts as possible — ideally dedicated admin accounts that are not used for day-to-day email and browsing. Admin accounts should require MFA through a dedicated authenticator app, not SMS, and should be reviewed at least quarterly to confirm that only current, appropriate personnel hold elevated permissions.
What cyber insurance and compliance auditors are asking for
Identity controls are now front and center in cyber insurance underwriting questionnaires and compliance assessments. Specific items that insurers and auditors ask about include:
- Whether MFA is enforced for all users accessing email and cloud systems remotely
- Whether privileged accounts have separate credentials from standard user accounts
- Whether legacy authentication protocols have been disabled
- Whether the organization has a documented password policy and enforces minimum complexity requirements
- Whether access is reviewed periodically and deprovisioned promptly upon employee departure
For businesses pursuing SOC 2, HIPAA compliance, or responding to cyber insurance renewal questionnaires, being able to answer yes to all of these — with evidence — is increasingly a requirement rather than a differentiator. Organizations that cannot demonstrate these controls are seeing higher premiums, lower coverage limits, or outright declination at renewal.
How to approach the audit
The starting point for identity hardening is a current-state audit of your authentication environment. For Microsoft 365 organizations, the Microsoft Secure Score dashboard provides an immediate snapshot of which identity controls are in place and which are missing, with prioritized recommendations. It is a useful free tool for understanding where you stand before you prioritize remediation work.
For organizations that want a more thorough assessment — including a review of conditional access policies, privileged role assignments, legacy auth status, and sign-in log anomalies — working with a managed IT partner that specializes in Microsoft 365 security is the fastest path to a defensible baseline.
At Perez Technology Group, we help Central Florida businesses assess and harden their identity security posture as part of a broader managed cybersecurity engagement. If your organization has not systematically reviewed its authentication controls in the past 12 months, now is the right time to close those gaps before an attacker finds them first. Reach out for a no-obligation assessment.
