Intechtel

MFA fatigue is one of the most common attacks on small businesses today, and most owners don't know it by name.

The attacker already has the password (bought from a leak or stolen from another site). They log in. The MFA push hits your employee's phone. They tap "Deny." The attacker tries again 10 seconds later. Then again at 2am. Then during lunch. Eventually someone taps "Approve" just to make it stop. The attacker is in.

Uber got hit this way in 2022. Cisco too. It still works on small businesses every week because passwords keep leaking and the push prompt looks identical to a real login.

Three things close the gap, and none of them are expensive. Switch your team from "tap to approve" to number matching, which both Microsoft Authenticator and Duo support out of the box and takes about 10 minutes to enable in your tenant. Then turn on geo-blocking or impossible-travel rules in your identity platform so logins from countries you don't operate in get blocked before the push ever fires. Last, give your team one rule: if you get an MFA prompt you didn't ask for, deny it AND report it. The report is what catches the attacker mid-attempt.

The attacker doesn't need a fancy hack. They just need someone tired enough to tap "Approve."

Verizon's 2026 Data Breach Investigations Report came out this month, and the patching numbers should worry every small business owner.

The median patch time across all confirmed breaches slipped from 32 days last year to 43 days this year. Only 26% of bugs on CISA's official "fix this now" list got fully patched. Vulnerability exploitation is now the most common way attackers break in, beating credential theft and phishing as the top initial access method.

If you've ever felt your business was too small to be a target, the math says otherwise. Small businesses make up the majority of confirmed cybercrime victims year after year across multiple industry reports.

Three things worth doing this week:
-Pull your patch report. Anything on CISA's Known Exploited Vulnerabilities list that's been unpatched for over two weeks goes to the top of your list.
-Audit who has admin access on your critical systems. Most hackers don't use fancy exploits. They log in with accounts that have too much access.
-Run a real backup restore test this month. "We have backups" isn't enough. Prove they work.

Forty-three days is plenty of time for a known vulnerability to be exploited. Close that window.

Verizon DBIR: Vulnerability exploitation is the dominant initial access vector - Help Net Security Verizon 2026 DBIR surfaced crucial findings and confirmed already observed trends, such as the rise of third-party involvement in breaches.