The uncomfortable truth about Irish SMEs and passwords

If you’re running a business with 10 to 100 staff members, there’s a good chance your IT security relies on something that stopped being secure about fifteen years ago: passwords alone.

We’ve seen it hundreds of times. A business owner tells us their team uses “pretty strong passwords,” or they’ve got a password policy. But here’s the thing—even a 12-character password with numbers and symbols gets cracked or compromised faster than most people think. And once someone has an employee’s password, they’re in. They can access your email, your cloud files, your financial systems, everything.

This isn’t theoretical. Last year, the Irish Data Protection Commission published guidance on common breaches affecting Irish businesses, and weak authentication was right there in the top reasons for incidents.

What multi-factor authentication actually is (it’s simpler than it sounds)

Multi-factor authentication—or MFA—just means requiring two or more ways to prove you’re really you.

Typically, this looks like:

• Something you know (your password)
• Something you have (your phone, or a security key)
• Something you are (your fingerprint or face)

So when you log into Microsoft 365 or your email, you enter your password, and then you’re asked to approve a notification on your phone, or you enter a code from an app. That’s it.

Yes, it takes an extra 10 seconds. No, it’s not perfect. But it stops roughly 99% of common attacks—including the ones where criminals buy stolen passwords on the dark web and just… try them.

Why Irish SMEs are dragging their feet

We talk to business owners regularly, and the reasons are always the same:

• “It’ll slow down our team” — It won’t, meaningfully. Once set up, most people barely notice it.
• “Our staff will complain” — Some will, initially. Then they’ll get used to it in a week.
• “It costs too much” — It often costs nothing. Microsoft 365 includes it. Google Workspace includes it. Standalone apps like Microsoft Authenticator are free.
• “We’re not important enough to target” — This one hurts. SMEs are exactly the target. Fewer defences, valuable data, often easier to convince someone to click a link.

The actual steps to take

If you’re running Microsoft 365 (and most Irish SMEs are), MFA is already available to you at no extra cost.

1. Start with your admin and finance team. Not everyone needs it day one. Begin with the people who handle sensitive data.
2. Use Microsoft Authenticator or Authenticator apps on phones. They’re free and more reliable than SMS codes.
3. Give people notice. Tell your team a week in advance so they’re not blindsided.
4. Set up a backup method. People lose phones. Have a second authentication method ready.

What you should actually worry about

From a GDPR perspective (DPC guidance is clear on this), you’re required to implement “appropriate technical measures” to protect personal data. If you’re breached because you didn’t use available security tools, that’s harder to defend.

If you’re genuinely unsure whether your business has MFA enabled across your email and cloud systems, it’s worth a 20-minute conversation with whoever manages your IT. It might take a day to roll out properly, but it’s one of the highest-return security moves you can make.