The return on MFA
May 29th, 2024 by Jesper Kråkhede
Following my post on MFA for admins, let´s look at the numbers, because MFA is one of the few security investments where the business case is almost embarrassingly clear.
Take an organisation with about 1,000 employees. Let´s estimate the cost of rolling out MFA properly: about 400 hours of project work at 100 euro an hour is 40,000 euro. Hardware security keys for 20 admins, around 1,200 euro. Support and administration, about 10,000 euro per year. In total roughly 51,000 euro the first year. Licences for MFA are included in many of the plans organisations already pay for, so I leave them out.
Now the other side. A widely quoted industry report put the average cost of a data breach last year at about 4.45 million dollars, roughly 4.1 million euro. Let´s say the risk of a serious incident through a compromised account is 10 % per year. Microsoft has said that MFA blocks more than 99.9 % of account compromise attacks. Let´s be conservative and say 99 %.
The expected loss avoided is then about 408,000 euro per year. The first year, that is a return of roughly 700 %. The following years, when only support remains, it is around 4,000 %.
You can argue about every assumption. Halve the incident cost, halve the probability, and MFA still pays for itself several times over.
There aren´t many investments that give you that. Take it.