Use of two-step verification has doubled since 2017

Two-step verification or two-factor authentication (2FA) is a way of logging in which, in addition to a password, requires an additional code which is different for each login session. The user may be sent this code by text message, through an app, or on a separate device.

Companies with a password policy require employees or customers to choose a strong password that meets certain requirements. It may need to include numbers, capital letters and special characters, for instance.

Large companies are more likely to use secure log-in methods

Large companies are more likely to use secure log-in methods than small companies. For instance, 97 percent of companies with 250 or more employees used two-step verification in 2024, compared with 57 percent of companies with between 2 and 10 employees. A similar pattern can be seen in the share of companies with password policies.

Bigger shift among smaller companies

The use of secure log-in practices has increased more among smaller companies. For example, the use of two-step verification by companies with between 10 and 50 employees has more than doubled, from 29 percent in 2017 to 76 percent in 2024. The number of companies with a policy requiring strong passwords has also increased in this category, from 64 percent in 2017, to 80 percent in 2024.

Two-step verification least common in hospitality sector

Two-step verification in 2024 was used most commonly by companies in the information and communication sector (88 percent), followed by financial services (83 percent) and health and social care (80 percent). In the hospitality (or food and accommodation services) sector, two-step verification was used the least widely, but also increased by the most, from 16 percent in 2017, to 44 percent in 2024. A similar picture can be seen for the percentage of companies with a password policy.

Downward trend in number of cyber incidents