5 Quick Fixes for Everyday IT Problems

You can move a small business to phishing-resistant authentication in about 30 days. Audit your accounts in week one, pilot passkeys or security keys with your highest-risk users in week two, roll out to everyone in week three, and enforce the new rules in week four.

Most small businesses already have some form of multi-factor authentication (MFA). The catch is that not all MFA stops a modern phishing attack. This guide shows you how to close that gap without grinding your team to a halt.

Why this matters for Australian businesses

Cybercrime isn't a distant risk. ASD received over 84,700 cybercrime reports in 2024–25, roughly one every six minutes. For small businesses, the average self-reported cost per report climbed 14% to $56,600. That's a serious hit for a business with a handful of staff and one bank account.

Identity is the weak point. Business email compromise is among the top cybercrime types affecting Australian businesses. Most of these attacks begin when someone's login gets stolen. 

The Australian Government has also raised the bar. ASD added phishing-resistant MFA to the Essential Eight at Maturity Level 2 in November 2023. The Australian Cyber Security Centre's guidance says it should be used across online services, systems and data repositories. 

What is phishing-resistant authentication?

Phishing-resistant authentication proves who you are in a way a fake website can't intercept. It's usually built on FIDO2/WebAuthn standards, which tie your login to the genuine website or app.

Common phishing-resistant options include:

• Passkeys stored on a phone, laptop or password manager

• FIDO2 security keys, which are small physical keys you plug in or tap

• Windows Hello for Business, which uses a device-bound credential with a PIN or biometric

• Certificate-based authentication, which suits more technical environments

Methods that attackers can still use to trick people into handing over include:

• SMS codes

• Six-digit codes from an authenticator app

• Basic "approve" push notifications

Worth knowing: multi-step authentication, such as a password followed by a security question, isn't a proper substitute for MFA. 

cyber

Your 30-day plan at a glance

Week	Focus	Main outcome
Week 1 (Days 1–7)	Discover and prioritise	You know what needs protecting first
Week 2 (Days 8–14)	Choose and pilot	Admins and key staff are protected
Week 3 (Days 15–21)	Roll out and train.	Everyone has a registered method.
Week 4 (Days 22–30)	Enforce and review	Weak methods are switched off.

Week 1: Discover and prioritise (Days 1–7)

You can't protect what you haven't listed. Keep this week simple.

• List Every System Staff Log Into: Include email, Microsoft 365 or Google Workspace, accounting software, banking, payroll, your CRM, and remote access tools.

• Identify Your Highest-Risk Accounts: Start with admins, owners, finance staff, and anyone who can approve payments.

• Check How MFA is Set Up Today: Note who uses SMS, app codes, push approvals, or nothing at all.

• Find the Gaps: Look for shared logins, old accounts from former staff, and apps that don't support modern sign-in.

• Pick Your Method: For most small businesses, a mix works well: passkeys for everyday staff and hardware security keys for admins.

Quick Win: Remove or disable accounts that no longer belong to anyone. They're easy targets.

Week 2: Choose and Pilot (Days 8–14)

Test with a small group before you touch the whole business.

• Order security keys. Buy at least two per admin, so a lost key doesn't lock anyone out. Prices vary, but plan on roughly 50–120 per key.

• Set up emergency access. Create two protected "break-glass" admin accounts, stored securely and monitored.

• Enable passkey or FIDO2 sign-in for your pilot group, such as the owner, finance, and IT admins.

• Apply sensible policies. In Microsoft 365, Conditional Access can require stronger sign-in for selected people or apps.

• Gather feedback. Ask what felt slow or confusing, and fix it before the wider rollout.

Week 3: Roll out and train (Days 15–21)

This is where most plans succeed or fail, and it comes down to people, not technology.

• Brief your team in plain English. Explain why you're doing it: attackers are after logins, and this change protects everyone.

• Run short registration sessions. Ten minutes per person is usually enough, in groups or one-on-one.

• Provide a step-by-step guide with screenshots and a contact for help.

• Use "report-only" mode first if your platform supports it. You'll see who would be blocked before you actually block anyone.

• Track registration. Follow up with anyone who hasn't enrolled by day 21.

Tip for Remote and Hybrid Teams: Courier keys to staff in advance, and run a video call to walk them through setup.

Week 4: Enforce and review (Days 22–30)

Now you lock the door properly.

• Require phishing-resistant sign-in for admins and sensitive systems first.

• Switch off weaker methods such as SMS and basic push approvals once everyone has a replacement.

• Block legacy sign-in methods that bypass MFA entirely.

• Document your recovery process. Decide how a staff member proves their identity if they lose a key or phone.

• Test it. Simulate a lost device and confirm your recovery steps work.

• Schedule a review. Check access quarterly and whenever staff join, leave, or change roles.

Common Mistakes to Avoid

• Rolling out to everyone on day one. Pilot first.

• Giving admins only one key. Always have a backup.

• Leaving SMS switched on "just in case". Attackers will aim for the weakest door.

• Skipping staff communication. Surprise lockouts create frustration and workarounds.

• Forgetting suppliers and contractors. Anyone with access to your systems needs the same protection.

When to Bring in Expert Help

A 30-day plan is realistic, but it takes time away from running your business. Many small businesses lean on a provider of managed IT services to handle the technical side while they focus on customers.

Good IT support helps in practical ways. It means someone to answer "I've lost my key" on a Monday morning, a team that sets up policies correctly the first time, and staff who explain things without jargon. Attackers don't work business hours either, so 24/7 support and monitoring mean odd-hour sign-in alerts get looked at promptly.

Authentication is also only one layer of protection. Alongside it, managed cybersecurity services typically cover backups, device protection, patching and staff awareness training. They fit neatly with the Essential Eight, the Australian Government's recommended baseline.

Elevate Technology works with Australian businesses from its Brisbane headquarters, with additional locations in Mackay, Sydney and Newcastle. As a Microsoft Solutions Partner for Modern Work, the team supports secure Microsoft 365 environments with fixed-fee pricing and no long-term contracts.

Next steps

You don't need to fix everything at once. Start with your admin and finance accounts this week, and the rest of the 30-day plan will follow.

If you'd like a hand, Elevate Technology offers a free quote and a no-pressure chat about your setup. Call +61 1300 463 538 or visit elevate.au to get started.

FAQs:

1. What is phishing-resistant MFA?

It's an authentication method that can't easily be tricked or intercepted by a fake login page. Passkeys and FIDO2 security keys are the most common examples. They only work with the genuine website, so a convincing phishing link won't capture usable credentials.

2. Is regular MFA enough for a small business?

It's much better than a password alone, but it isn't foolproof. Attackers can trick staff into entering SMS or app codes on fake sites. Phishing-resistant methods close that gap, so they're worth adopting, starting with admin and finance accounts.

3. How long does it take to implement phishing-resistant authentication?

Around 30 days for most small businesses, assuming a clear plan, a short pilot, and basic staff training. Larger or more complex environments, or those with older systems, may need longer.

4. How much does it cost?

The main costs are hardware keys (roughly 50–120 each if you use them), staff time, and possibly support from an IT provider. Passkeys on phones or laptops can often be used at little or no extra cost, depending on your licensing.

5. Are passkeys safe enough for business use?

Yes, they're widely regarded as phishing-resistant. Device-bound passkeys and hardware keys offer the strongest assurance. Synced passkeys are convenient, though the credential is copied across a user's devices, so many businesses use hardware keys for privileged accounts.

6. Does this help with the Essential Eight?

Yes. MFA is one of the Essential Eight mitigation strategies, and phishing-resistant MFA is now expected at Maturity Level 2. Implementing it moves your business closer to the ASD's recommended baseline.

7. What happens if an employee loses their security key?

Remove the lost key from their account immediately, then verify their identity using your documented recovery process. Issue a replacement and register it. Having a second registered method per person makes this far less stressful.