multi-factor authentication

ESET reports that 49% of UK small and medium-sized businesses have suffered a security breach, with cybersecurity experts outlining practical measures firms can take to reduce risk. The findings highlight persistent gaps in SMB defences, and commentary is focused on affordable fixes such as staff training, patching and multi-factor authentication that smaller firms can adopt without large budgets.

Hotel Technology News reports that hotels face growing risk from password attacks that can expose guest information such as payment details and identity records. The piece outlines steps hospitality operators can take, including stronger password policies, multi-factor authentication and staff training, to protect guest data and avoid breaches that damage reputation and trigger regulatory penalties.

Hundreds of local election jurisdictions across Wisconsin are not following recommended cybersecurity best practices, according to reporting by Votebeat. The finding raises questions about the security of election infrastructure in the state ahead of upcoming votes, as experts urge local clerks to adopt stronger protections such as multi-factor authentication and regular security audits.

A cybersecurity commentator is asking whether the way the world authenticates to thousands of online services is sustainable, arguing that current login systems outpace the technical literacy of users across generations. The remark has struck a chord among information security professionals, who regularly point to passwords, phishing, and inconsistent security standards as growing problems. It feeds into a wider debate over passkeys, multi-factor authentication, and how to design account security that ordinary people can actually manage.

A vulnerability tracked as CVE-2026-105305 affects the Red Hat build of Keycloak. The OIDC Device Authorization Grant flow fails to enforce a client's minimum authentication level, meaning a stolen password could bypass mandatory multi-factor authentication and gain access to the Admin REST API. No exploitation has been confirmed, and Red Hat has a fix available. Security practitioners are sharing the advisory and urging admins to patch promptly.

The US Department of War is marking Cybersecurity Awareness Month by promoting its 'Brilliant at the Basics' campaign, urging staff and the wider public to follow fundamental cyber hygiene such as strong passwords, phishing awareness and multi-factor authentication. The initiative highlights how basic defensive practices remain the department's core message against growing digital threats.

Guidance is circulating on affordable cybersecurity fundamentals for small businesses, arguing that basic low-cost measures — such as strong passwords, multi-factor authentication, software updates and staff awareness — can prevent the majority of common attacks. Small firms are often targeted because they lack dedicated security teams, and owners are being encouraged to prioritise these simple defenses over expensive solutions.

Scammers are increasingly using artificial intelligence to craft convincing phishing messages, voice clones and fake identities, and security reporters are urging people to act. Practical steps being highlighted include turning on multi-factor authentication, tightening privacy settings, limiting what personal information is publicly visible, and being skeptical of urgent requests, even when they appear to come from someone you know.

Cybersecurity commentators are warning that multi-factor authentication, despite protecting roughly 70% of enterprise users, does not guarantee that a user's identity is genuinely legitimate. Attackers can sidestep MFA through account recovery flows and session hijacking exploits, meaning it proves control of an authenticator rather than true identity. Security professionals are debating how organisations should treat MFA as one layer, not proof of trustworthiness.

Security reporting warns that hackers are stealing companies' AI account credentials and using them to run expensive tasks at the victim's expense. Businesses are advised to protect themselves with strong passwords, multi-factor authentication, and close monitoring of monthly usage bills to spot suspicious AI consumption early.