Try “SSH”, “passkeys”, “WordPress” or “Content-Security-Policy”.
Section · 6 guides
Most attacks succeed through ordinary gaps: a reused password, a missed update, a backup nobody tested. These guides close the common gaps first, with steps a small team can finish in an afternoon.
/hardening/Twelve controls, ordered by impact, that protect a team of one to fifty people against the break-ins that actually happen, from MFA and a password manager to offboarding and an incident contact list.
Critical impact6 min
Passkeys, hardware security keys, authenticator apps, push approval, SMS and email codes all count as MFA, but they fail in very different ways. A comparison by phishing resistance, recovery and everyday use.
Critical impact5 min
Ransomware looks for your backups before it encrypts anything else. How to keep copies it cannot reach: the 3-2-1-1-0 rule, immutable storage, separate credentials, SaaS data and restore drills that prove it all works.
Critical impact5 min
Attackers routinely exploit flaws that already have a fix. A realistic update routine for small teams: automatic updates, a weekly slot, priorities from the known exploited list, firmware, testing and end of support.
High impact5 min
Length beats complexity, reuse is the real danger and forced rotation does more harm than good. What current NIST guidance says, how cracking works online and offline, and where password managers fit in.
High impact5 min
AI-written phishing leaves no spelling mistakes to spot. The signals that still work: sender domains, look-alike and IDN homograph tricks, link targets, QR codes, callback scams, surprise MFA prompts and payment changes.
High impact5 min
Compare
Interactive comparison
Six common second factors scored for individuals and small teams, from 1 to 5, where higher is always better.
Best everyday choice for anyone whose services offer them.
The dependable default where passkeys are not available.
Best for administrators, payment approvers and other likely targets.
Acceptable inside an identity platform, but only with number matching on.
A fallback for services that offer nothing stronger.
Better than nothing, but replace it wherever a service allows.
| Criterion | Passkeys (synced) | Authenticator app (TOTP) | Hardware security key (FIDO2) | Push approval with number matching | SMS or voice codes | Email codes |
|---|---|---|---|---|---|---|
| Phishing resistance | ||||||
| SIM swap resistance | ||||||
| Ease of use | ||||||
| Easy recovery | ||||||
| Low cost | ||||||
| Support across services |
Editorial assessment as of 31 October 2026. Scores from 1 to 5, higher is better. Your weights only change the order. Read the full comparison
Tools for this section
