No One Gets a Pass: Bringing Senior Accounts Into the MFA Rule

Most UK SMEs can point to a multi-factor authentication policy. Fewer can point to a managing director who follows it. The gap is rarely a technical failure. It is a governance failure that has been allowed to become a matter of status, habit and avoided conversation. The result is an estate where ordinary staff wrestle with authenticator apps while the account with the widest access, the most sensitive mail and the strongest ability to approve payments sits outside the rule.

That position is difficult to defend in 2026. Phishing kits are cheaper, session-token theft is better understood, and insurers, clients and auditors ask sharper questions about privileged access. The answer is not a boardroom fight. It is a short, well-run programme that makes the secure path the normal path and gives the managing director a dignified way to comply.

The exception is a governance artefact, not a perk

In many organisations the executive exception is not a formal decision. It is an accumulation of small conveniences: the MD travels often, changes phones, relies on a personal assistant, or finds the authenticator prompt irritating during meetings. Someone quietly stopped enforcing the rule, and the helpdesk learned not to ask. That is how policy becomes theatre.

Treat the exception as a risk acceptance, not a privilege. A risk acceptance needs a scope, an owner, a reason, a compensating control and an expiry date. It should sit in a register that the board or a delegated committee can see. Once the exception is written down, it becomes much easier to close, because the conversation moves from personality to process.

Start with the account, not the person

Before changing behaviour, inventory the identity estate. List the managing director’s named account, any privileged roles attached to it, shared mailboxes the account can access, and any executive assistant or chief of staff who works on the MD’s behalf. Check for old accounts, delegate access and personal email addresses used for password resets. The aim is not surveillance. It is to understand where the real risk sits.

Pay particular attention to roles that can approve payments, change finance settings, create accounts or read all mail. An executive mailbox is often the key to invoice fraud because it contains context, contacts and authority. If that account is protected only by a password, the organisation is relying on luck.

Make the default path the easy path

The strongest practical control for senior accounts is a FIDO2 hardware security key. It resists phishing, does not rely on a phone number and works without a mobile signal. Issue two keys: one on the keyring and one in a secure drawer or safe. Enrol them in a short session with the MD and a trusted IT contact, then test sign-in from a laptop, a phone and a remote location.

For Microsoft 365 and similar estates, pair the key with conditional access. Require strong authentication for all users, then add controls for privileged roles: compliant device, trusted network where appropriate, and risk-based sign-in policies. Do not make location the only factor. Travel is normal; location is not an identity.

Where hardware keys are genuinely impractical, use an authenticator app with number matching and avoid SMS as the primary factor. SMS is better than nothing, but it is vulnerable to SIM swaps and number recycling. If the MD insists on a phone-based method, record it as a temporary exception with a review date.

Helpdesk checks that survive a rushed call

The executive exception often survives because the helpdesk is trained to be helpful. A caller says he is the managing director, sounds stressed, and asks for a reset. The path of least resistance is to comply. That is exactly the moment a security programme fails.

Write a short identity verification script for privileged accounts. It should require a callback to a known number, not a number supplied by the caller. It should use a challenge code or a pre-agreed phrase held in the identity record. It should require a second approver for executive resets. It should log the request, the verification method and the outcome. None of this needs to be adversarial. It simply removes ambiguity from a rushed call.

Brief the MD and the executive assistant on the script before it goes live. Explain that the checks apply to everyone, including the IT director. A control that protects the MD from impersonation is easier to accept than a control that feels like mistrust.

Keep a short exception register

Some exceptions will be legitimate. A board member may have a disability that makes a hardware key difficult. A travelling executive may need a temporary software token. A contractor may need time-limited access. The answer is not zero exceptions. The answer is visible, time-bound exceptions.

Use a one-page register with six columns: name or role, system, reason, compensating control, owner and expiry date. Review it quarterly. If an exception has no expiry date, it is not an exception; it is a permanent weakness. If it has no compensating control, it is an open door.

The conversation, not the confrontation

Bringing the MD into scope works best when it is framed as operational resilience rather than personal compliance. Mention client requirements, cyber insurance questionnaires, Cyber Essentials expectations and the reputational cost of a mailbox breach. Offer a short enrolment clinic rather than a policy lecture. Ask the MD to sponsor the change publicly, even with a single sentence at a management meeting.

The goal is not to win an argument. It is to remove a known weak point without creating a culture of exceptions. Once the managing director uses a key, the rest of the executive team will follow. The helpdesk will enforce the script because it has been endorsed from the top. The exception register will shrink because the reason for the exception has disappeared.

What good looks like after thirty days

All privileged accounts require strong authentication. Every executive has two registered FIDO2 keys or a documented temporary alternative. The helpdesk has a written verification script and a second-approver rule for executive resets. The exception register has an owner and a review date. The board has seen a one-page summary, not a technical report.

That is not a revolution. It is housekeeping. But it closes a gap that many UK SMEs have tolerated for years. The managing director does not need a special pass. The organisation needs a rule that applies to everyone, and a practical route to comply.