Password and identity protection

Stolen or guessed passwords are behind a large share of break-ins at small companies. Once an attacker has an employee's email password, they can read invoices, set up forwarding rules, reset passwords for other services and send convincing scams to customers. The tools in this category make passwords harder to steal and less useful when they are.

Password managers are the first piece. Each person gets an encrypted vault, the app creates a strong unique password for every site and fills it in, and teams share logins through shared vaults instead of spreadsheets or sticky notes. When someone leaves, an admin removes their access to every shared login at once. Most business password managers also warn about weak, reused or breached passwords, and can watch for company addresses in known data leaks.

Identity providers are the second piece. They hold the list of user accounts and handle sign-in for the apps a company uses, through single sign-on. Staff log in once with strong multi-factor authentication, and the provider signs them into email, file storage, accounting and other apps. When someone leaves, disabling one account removes access everywhere. Microsoft 365 companies already have Microsoft Entra ID, and Google Workspace has its own directory, so many small businesses start there.

Multi-factor authentication is the most effective single control here. A push approval, an authenticator code, or, stronger still, a passkey or hardware security key, means a stolen password alone is not enough. Attackers now use fake login pages that relay the code in real time, so phishing-resistant methods such as passkeys and security keys are worth favoring for admin accounts and email.

The AI in this category is mostly about risk at sign-in: models that score each login by location, device and behavior, and ask for more proof or block it when something looks off. Some tools watch for stolen session tokens, and browser-based tools can spot when staff type a work password into an unknown site.