Two-factor and multi-factor authentication

In ascending order of resistance: SMS codes, which are defeated by SIM swap and by phishing pages that relay the code in real time; app-generated codes, which survive SIM swap but are still relayed by a convincing phishing page; push approvals, which add fatigue attacks where a user eventually taps yes to stop the prompts; and hardware keys or passkeys, which are bound to the site's origin and therefore cannot be handed to a fake one.

For the accounts a business is actually attacked through — the mail account, the ad account, the social profiles, the domain registrar — the only category that stops a competent phishing attempt is the last one. Everything above it is a speed bump.

SMS on the account that recovers all the others

Protecting the business accounts strongly while the mail account behind them keeps SMS recovery is a lock on a door with the window open. Attackers do not attack the ad account; they take the mailbox and ask it politely for everything else.

Account recovery path

The chain of accounts that can reset each other's passwords — and therefore the real security level of every account in it, which is the level of the weakest.

---

Business email compromise

Fraud carried out through a real or convincingly forged company mailbox, usually to redirect a payment — and by value, the most damaging attack a normal business faces.

---

Password managers and passkeys

Two mechanisms that remove the human from the part of authentication humans are worst at — remembering secrets, and judging which site to give them to.

All forty-five termsWhat this is regulated by in the UAE

Is this one right in your own numbers?

The definitions are the easy part. Whether the figure on your dashboard was computed this way is a different question, and usually the more expensive one.