Two-factor authentication for the accounts that run your business

Your password was probably leaked at a company you have never dealt with; two-factor exists precisely because that is not your failure to prevent.

A short list of accounts runs a company: the domain registrar, the email system, the hosting, the social profiles, the license portal. None of them feels dramatic on a normal day, and every one of them is irreplaceable on a bad one. There is exactly one habit that keeps this list yours, and it is two-factor authentication.

The honest framing starts somewhere uncomfortable: passwords leak at other companies, not yours. The breaches that matter to your accounts usually happen at services you never chose to see breached, and a reused password gets tried there, everywhere, automatically, for years. Two-factor exists precisely because of this: a second proof, held in your hand rather than in a database someone else can lose.

The failure versions are quiet and total. The hijacked domain, where the company's address on the internet is redirected or held, and every email, every link, every campaign follows it down. The mailbox that sends as you, reading the correspondence before you do and answering your own clients in your name. And the recovery phone that belongs to a founder who left years ago, which nobody discovers until the night the account has to be recovered.

Turn it on in order of blast radius, not in order of convenience. The registrar first, because whoever controls the domain controls everything that answers to it; then the email, because whoever controls the mailbox speaks with the company's voice; then the hosting, the profiles, and the rest. Each account that gains a second factor becomes one that can no longer be taken with a leaked password alone.

Store the recovery codes offline, printed and kept as a pair with the ownership records, the same discipline that decides whose name an account is in; a second factor you cannot reach in a crisis is a lock whose key was thrown away. And give departing staff an off-boarding step that says this explicitly: their devices stop being trusted factors, their access is revoked, and the recovery paths no longer route through a person who has left.

We run this discipline on the accounts that carry our own work, which is how we can say the setup is an afternoon and the maintenance is a habit rather than a project. When we hand a client their domain and their mail, the handover includes this practice, because an account we set up and left unguarded would be a favor done for the next attacker. Guidance, not guarantees: two-factor does not make a company unbreakable, it removes the cheapest path in, which is exactly the path that gets used.