It did not start with a Hollywood-style hack. A finance manager at a local logistics company received an email that looked like it came from their IT provider. She clicked the link, typed in her username and password on what looked like a familiar login page, and carried on with her day.
By the following morning, someone else was inside the company's systems — reading financial records, downloading contracts, and accessing staff files. The entire incident started with one password, typed once, on the wrong page.
Why Passwords Are No Longer Enough
Passwords made sense when we had one or two accounts to protect. Today, the average office worker manages around 70 different work logins — and that number has been as high as 87 in recent years (NordPass, 2024). Nobody can remember 70 unique, complicated passwords — so most people do the same thing: they reuse a small number of familiar ones across many different accounts.
This is exactly what attackers count on. The numbers tell the story:
- More than 80% of business break-ins involve a stolen or guessed password. Not hacking — just logging in with someone else's details.
- Stolen passwords are sold online within hours of a breach — often before the victim even knows something has happened.
- One reused password can unlock several systems at once. A leak from one site becomes a key to many others.
The fault does not lie with employees. The system was simply never built to handle this many accounts, this many attacks, or this level of connection between different services.
The Simple Fix Most Businesses Have Not Switched On
Multi-Factor Authentication — or MFA — is a second check that happens after you type your password. Think of it like an ATM: the card is your password, and the PIN is the second step. Even if someone steals your card, they cannot get your money without the PIN.
In practice, MFA usually means your phone receives a code or a tap-to-approve prompt whenever someone tries to log in. If an attacker steals your password, they still cannot get in without your phone. Microsoft estimates that MFA alone blocks more than 99% of automated password attacks.
Despite this, a large number of Malaysian businesses have still not switched it on — particularly on the systems that matter most.
--- Where every business should have MFA switched on
Email — the master key to almost everything else in your business.
Finance and accounting systems — direct access to money and sensitive records.
Cloud storage and file-sharing — where contracts, proposals, and data live.
Remote access and VPN — the main entry point for anyone logging in from outside the office.
Any system that holds customer or employee information. ---
The Next Step: Logging In Without a Password at All
Passkeys are a newer way to log in that does away with passwords entirely. Instead of typing something you have memorised, your phone or laptop confirms it is really you — using your fingerprint, your face, or a PIN that never leaves your device.
Nothing gets typed. Nothing gets sent over the internet. Nothing can be stolen by a fake login page. Even if an attacker somehow intercepts the process, what they get is completely useless without your actual device.
This is not a distant technology. Google, Microsoft, Apple, and most major business platforms already support passkeys. The shift has quietly begun — for consumer accounts today, and for business systems increasingly over the next 12 to 24 months.
What You Can Do Starting This Month
You do not need to overhaul everything at once. These five steps, taken in order, will reduce your exposure significantly:
- Switch on MFA today. Do this on email, finance platforms, cloud storage, and remote access first. It is the single most effective step available — and it costs nothing to enable.
- Check who still has access. When staff leave or change roles, their old login details are often left active. A quick review of user accounts closes doors you may not have known were open.
- Move to a password manager. A password manager creates and remembers a unique, complex password for every account automatically. Your team stops reusing passwords without any extra effort.
- Start using passkeys where you can. Begin with your highest-risk accounts. Most people find them quicker and easier than passwords — there is nothing to type and nothing to forget.
- Train your team to spot fake login pages. Technology can only go so far. A short, regular briefing on how to recognise a suspicious email or link remains one of the most practical defences available.
Moving away from passwords is not really a technology decision. It is a decision about how seriously your organisation takes protecting the access to everything it owns. Those who act before a breach are in a far stronger position than those who act after one.
How exposed is your business right now?
Take our free 2-minute Credential Security Risk Check — 8 questions that reveal exactly where your password-related vulnerabilities are, and what to fix first.