Cybersecurity·31 October 2026·6 min read
In short
The Centre for Cybersecurity Belgium (CCB) writes that two-step login makes it harder for a criminal to get into email and billing systems even when the password has been stolen. It asks every company to require it for all access to business applications from the internet, starting with logins to applications such as email, remote access and admin rights (CCB, Safeonweb@work). CyberFundamentals Small, the CCB's starting level for micro-organisations and organisations with limited technical knowledge, opens with "protect all logins with multi-factor authentication" (CCB, CyberFundamentals).
Eurostat counts the enterprises with 10 or more employees that combine at least two ways of signing in, such as a password plus a code on a phone. In Belgium that was 59.0% in 2024, up from 39.36% in 2022; across the EU it was 39.84% in 2024 (Eurostat).
Enterprises using at least two authentication methods
% of enterprises with 10 or more employees, financial sector not included. For example a password plus a code on a phone.
Eurostat measures this every two years; 2024 is the latest.
Source: Eurostat, table isoc_cisce_ra (ICT security in enterprises), updated 15 June 2026
List every account that signs in to your email: one per person, the admin accounts, shared addresses such as info@, and devices that send mail themselves, like a scanner. Tell staff the day and the app to install, as Google's deployment guide advises (Google). Under Microsoft security defaults, users have had no 14-day grace period to register since 29 July 2024 (Microsoft), so send staff to myprofile.microsoft.com, under Security info, beforehand.
Security defaults are one switch for the whole tenant, free and without settings. They make every user register, require two-step login from admins at every sign-in and from other users when Microsoft judges it necessary, and block legacy authentication: older protocols such as IMAP, POP3 and SMTP that cannot ask for a second step (Microsoft). The switch is in the Microsoft Entra admin center under Entra ID, Overview, Properties, Manage security defaults. Microsoft advises revoking existing sessions afterwards, so that everyone has to register.
Conditional Access lets you write your own rules. It needs at least a Microsoft Entra ID P1 licence, and Microsoft says security defaults are probably not right for an organisation with P1 or P2 (Microsoft). P1 is included in Microsoft 365 Business Premium (Microsoft). You switch security defaults off when your own policies take over. A policy can first run in report-only mode on a pilot group, which is where your test user goes. Security defaults have no pilot, so the test user registers before you flip the switch.
Before blocking legacy sign-in, open the sign-in logs in the Entra admin center, add the Client App column and filter on the legacy protocols (Microsoft). A scanner that emails documents will show up there.
In the Admin console, go to Security, Authentication, 2-step verification, as a super admin. Google's order: allow users to turn on 2-Step Verification with enforcement Off, let them enrol, follow progress in the Security report, then set enforcement to On or to a start date. Enforcement may begin 24 to 48 hours after that date (Google). The setting can differ per organisational unit, so give your test user a unit of their own.
The new user enrolment period gives a new employee from 1 day to 6 months to set it up, and until then they sign in with just a password, so keep it short. Google advises against skipping the second step on trusted devices unless users often switch devices. Third-party apps must now use OAuth; password access is gone, except for app passwords (Google).
The CCB calls a code by SMS or phone call the least secure option (CCB, Safeonweb@work). Microsoft writes that SMS, email codes and authenticator apps can still be caught by remote phishing, and recommends phishing-resistant methods such as passkeys, FIDO2 security keys and Windows Hello for Business (Microsoft). Google says passkeys and security keys give the same phishing protection, and calls security keys the most secure option for admin accounts (Google). For a small office: an authenticator app for everyone, a passkey or security key for the admins.
Under security defaults, users register Microsoft Authenticator or another code app (OATH TOTP). Authenticator makes the user type a number shown on the sign-in screen, which Microsoft says helps against MFA fatigue: a stream of prompts sent until someone taps Approve (Microsoft).
A shared address such as info@ should not be an account whose password the whole team knows. In Microsoft 365, every new shared mailbox has sign-in blocked by default (Microsoft). Staff open it with their own account and their own two-step login. Each shared mailbox also has a user account behind it, so check that sign-in is blocked on older ones too (Microsoft).
Ask staff before you assume they will put a work app on their own phone. Microsoft notes that relying on Authenticator can be a limitation when you cannot be sure it is installed on a personal device (Microsoft). The alternative is a security key on the keyring: Microsoft Entra ID accepts a passkey (FIDO2) as a second step, and Google Workspace accepts a security key under both the Any and the Only security key settings.
In Google Workspace, an admin can generate backup codes for a user from that user's security settings. Only a super admin can do this for another admin, and Google advises super admins to print codes for the other admins and keep them in a secure location (Google). Admin accounts also need a recovery phone number and email address. In Microsoft 365 the emergency access accounts are the safety net: keep their credentials in secure, separate places and test them at least every 90 days (Microsoft).
Two-step login protects the sign-in, not a session that is already open. Microsoft's incident responders describe two ways around it: a fake login page between the user and the real one that captures the password and the session token, and malware that copies browser cookies so the session can be reused elsewhere. Either way, the criminal passes the MFA check (Microsoft Security blog, 16 November 2022). Our article on fake Booking.com payment requests covers a credential-stealing malware campaign aimed at hotels.
Two-step login is half the work. The other half is staff who recognise a fake login page or a prompt they did not ask for. Our cyber awareness workshop covers fake login pages and which accounts need two-step login first. For a small office that wants its email and network basics checked, our offer starts with a free online call on the IT partner for small businesses page.
Ask Fluxive for a free, no-obligation call and a custom quote.
Cybersecurity
87.0% of Flemish hotel email domains give receiving servers no instruction to block a forged email in their name. This four-week plan takes a small hotel or business from no DMARC, or p=none, to p=reject, fixing one sender at a time and checking that booking confirmations, invoices and the newsletter still arrive.
Cybersecurity
A supplier announces a new bank account and asks you to pay today. That is how invoice fraud usually starts. These are the five signals to look for, and the check that stops it.
Cybersecurity
Guests receive a payment request with their real booking details, apparently from the hotel's own account. What the CCB and Microsoft have reported, what Booking.com says it never asks, and what reception and the owner can do.