12 steps to protect your business in 2026: MFA, passwords, training and deepfakes

Move to phishing-resistant MFA

Multi-factor authentication is still the most cost-effective measure, but not all MFA is equal. Text message codes can be intercepted, and “adversary-in-the-middle” phishing kits now steal the code and the session in real time.

Aim for passkeys, Windows Hello for Business or a FIDO2 security key: they refuse to work on a fake site.

• Microsoft made passkeys the default method in Entra ID on September 1^st, 2026.
• Entra ID’s native text message and voice call codes will be retired on February 1^st, 2027.
• Deny and report any MFA approval request you didn’t trigger.

Choose long passphrases, not complicated ones

The U.S. reference on the subject (NIST SP 800-63B, revision 4, July 2025) has turned the page on the old rules:

• 15 characters or more when the password is the only factor; a phrase like “canoe-maple-monday-mist” beats “P@ssw0rd!”.
• No more forced changes at fixed intervals: change only when there’s a compromise.
• No more mandatory complexity rules or security questions.
• New passwords are checked against lists of already-leaked passwords.

Use a password manager

One unique password per service, generated and remembered by a business password manager: that’s what keeps a leak at a supplier from becoming a way into your company. Add dark web monitoring so you’re alerted if your addresses or credentials are circulating there.

Automate updates

Windows, macOS, browsers, Microsoft 365, but also firewalls, VPNs and routers: attackers exploit known vulnerabilities faster and faster after they’re published. Critical patches get applied in days, not months.

Install detection on every computer and server

Traditional antivirus is no longer enough. A detection and response tool (EDR), monitored by a team, spots suspicious behaviour: mass file encryption, credential theft, an admin tool launched in the middle of the night.

Keep backups out of reach… and test them

3-2-1 rule: three copies, two types of media, one off-site, with at least one immutable or offline. Don’t forget Microsoft 365 (email, OneDrive, SharePoint, Teams), which isn’t fully backed up by default. A backup that’s never been restored is just a hope: test it.

Apply least privilege

Nobody works day to day with an administrator account. Admin accounts are separate, protected by a passkey and reserved for the tasks that require them. Accounts of departing employees are disabled the same day.

Harden your email

Email is still the main way in. Anti-phishing filtering, SPF, DKIM and DMARC records to stop spoofing of your domain, an “external email” banner, and alerts on auto-forwarding rules created without your knowledge.

Train continuously, not once a year

Annual training is quickly forgotten. What works: short, regular lessons, realistic phishing simulations and a culture where people report a mistake within five minutes instead of hiding it. A click admitted early costs far less than an intrusion discovered five weeks later.

Adopt a protocol against deepfakes and AI calls

A few seconds of public audio are now enough to clone a voice. Employees have already made multimillion-dollar transfers after a video call where the “CFO” and colleagues were all AI-generated.

• Mandatory call-back to a known number (never the one provided in the call or email) before any transfer or change of banking details.
• Code word agreed on in person between executives and accounting, never written in an email. Do the same with your family against the “grandchild in trouble” scam.
• Dual approval for payments above a threshold.
• Be wary of urgency and secrecy: they are the two levers behind all of these frauds.

Set rules for AI use at work

AI tools are valuable, but a confidential document pasted into a public tool can leave your control. Choose company-approved tools tied to your business accounts, and write a simple rule about what can and can’t be copied into them: client personal information, legal files, financial data.

Have a response plan ready… on paper

On the day of an attack, email and the network may no longer be available. Print out who to call (IT support, cyber insurer, lawyer), who makes the decisions, and how to isolate a computer without shutting it down. In Quebec, also plan for notifying the Commission d’accès à l’information if personal information is involved (Law 25).