Index › Identity and access › MFA › Small business › September 2026 Edition

Multi-factor authentication for small business buyers

Asked as “MFA solution”, and as “multi-factor authentication tool”, on behalf of a small B2B company. 60 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.

Standing

Cisco Duo

Clear leader

45% of first choices, clear leader.

ShowinginAll 67 categories →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

Small business

Cisco Duo45%Clear leaderThis page Mid-market

Cisco Duo42%Clear leaderStanding →Enterprise

Microsoft Entra ID40%ContestedStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a small B2B company. Ordered by share.

ProductFirst-choice shareNegative rateLabelsQuadrant

Cisco Duo5%61endorsed leader

Microsoft Entra ID2%44accepted challenger

Microsoft Authenticator22%18accepted challenger

Google Authenticator16%25accepted challenger

Google Workspace 2-Step Verification8%13accepted challenger

Okta28%32criticized challenger

Authy19%16accepted challenger

Show the four products at 0%, ordered by negative rate

Auth023%13accepted challenger

YubiKey9%22accepted challenger

JumpCloud0%10accepted challenger

JumpCloud Protect0%10accepted challenger

Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Head to head

Cisco Duo vs Microsoft Entra ID Cisco Duo vs Okta Microsoft Entra ID vs Okta

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default

Negative label rate →

Accepted challengerEndorsed leader

0%First-choice share → · lines at 30% share and 25% negative60%

Key

Cisco Duo45%

Microsoft Entra ID28%

Microsoft Authenticator7%

Google Authenticator5%

Google Workspace 2-Step Verification3%

Okta2%

Authy2%

YubiKey0%

JumpCloud Protect0%

JumpCloud0%

Auth00%

02What they warned about

Three of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.

Okta

28%

9 of 32 labels negative · 7 of 12 models

“No free tier for small businesses; Minimum commitment is 1,500 users for the lowest tier; Overkill for most small companies” GLM 4.7 FlashX, budget prompt

Cisco Duo

3 of 61 labels negative · 3 of 12 models

“Third-party Identity Providers (like Okta, Duo, or Azure AD P1/P2) can carry "punishing licensing fees"” Kimi K2, negative prompt

Google Authenticator

16%

4 of 25 labels negative · 3 of 12 models

“Be Cautious With: Standard Authenticator Apps (TOTP) for Admins Using apps like Google Authenticator or Microsoft Authenticator (in standard mode)” Qwen 3.7 Flash, negative prompt

Microsoft Authenticator

22%

4 of 18 labels negative · 3 of 12 models

“Push Notifications (e.g., simple "Approve/Deny" prompts from apps like Microsoft Authenticator) (Use cautiously; prefer enhanced versions)” Grok 4.1 Fast, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

61 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 5 of those lists are Google grounding redirects that name no site and are left out of the counts. 633 links across 172 sites, every framing counted. Ranked by the number of answers carrying the site or page.

encomputers.com

32 answers · 32 citations · 9 models

techrepublic.com

31 answers · 34 citations · 9 models

rippling.com

vendor site · Rippling28 answers · 28 citations · 9 models

duo.com

27 answers · 30 citations · 10 models

okta.com

vendor site · Okta22 answers · 33 citations · 10 models

miniorange.com

vendor site · miniOrange20 answers · 24 citations · 8 models

g2.com

18 answers · 22 citations · 9 models

cofes.com

17 answers · 17 citations · 7 models

expertinsights.com

vendor site · Expert Insights17 answers · 17 citations · 6 models

securityboulevard.com

16 answers · 20 citations · 10 models

plivo.com

vendor site · Plivo15 answers · 15 citations · 8 models

cisa.gov

9 answers · 12 citations · 7 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

encomputers.com/2024/05/best-multi-factor-authentication-small-businesses

32 answers · 9 models

techrepublic.com/article/best-multi-factor-authentication-solutions

30 answers · 9 models

rippling.com/blog/mfa-providers

25 answers · 8 models

okta.com/blog/identity-security/how-to-choose-the-right-mfa-for-your-small-…

18 answers · 9 models

cofes.com/mfa-solutions

17 answers · 7 models

expertinsights.com/identity-and-access-management/the-top-multi-factor-auth…

17 answers · 6 models

plivo.com/blog/best-multi-factor-authentication-solutions-for-business

15 answers · 8 models

securityboulevard.com/2025/12/10-best-multi-factor-authentication-tools-2025

14 answers · 9 models

miniorange.com/blog/cost-effective-mfa-for-small-business

12 answers · 6 models

duo.com/solutions/small-to-medium-business

10 answers · 7 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.

ModelDirect“What is the best MFA solution for a small B2B company?”Paraphrase“Which multi-factor authentication tool would you recommend to a small business that sells to other businesses?”Comparative“What are the top MFA solutions for a small team and how do they differ?”Budget-constrained“What is the best MFA solution for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a MFA solution. What should we look at?”Negative“Which MFA solutions should a small business avoid or be cautious about?”

Claude Haiku 4.5Cisco Duo

Two alternatives

Google Workspace 2-Step Verification, Microsoft Entra ID

Authy, Microsoft AuthenticatorChanged

Three alternatives

Cisco Duo, Google Authenticator, Okta

Cisco Duo

Two alternatives

JumpCloud, Microsoft Entra ID

Google Authenticator, Microsoft Authenticator

Four alternatives

Authy, Microsoft 365, Microsoft Entra ID, Windows Hello

no first choicenothing named

GPT-5.4 miniCisco Duo, Microsoft Entra ID

Two alternatives

FIDO2 security keys, Windows Hello

Microsoft Entra IDChanged

One alternative

Cisco Duo

against: OktaCisco Duo

One alternative

Microsoft Entra ID

against: Google Workspace 2-Step VerificationMicrosoft Entra security defaults + Microsoft Authenticator

One alternative

Cisco Duo

Google Workspace 2-Step Verification, Microsoft Entra ID, Oktanothing named

Gemini 3.5 FlashCisco Duo

Five alternatives

Clerk, Google Workspace 2-Step Verification, Microsoft Entra ID, WorkOS, miniOrange

against: Auth0Cisco Duo, WorkOSChanged

Four alternatives

Auth0, Datawiza, Google Workspace 2-Step Verification, Microsoft Entra ID

Cisco Duo

Six alternatives

1Password, Bitwarden, Google Authenticator, Google Workspace 2-Step Verification, Microsoft Entra ID, YubiKey

Cisco Duo, Microsoft Entra ID

Two alternatives

Bitwarden, Google Authenticator

against: Authelia, Authentik, KeycloakGoogle Workspace 2-Step Verification, Microsoft Entra ID

Two alternatives

Cisco Duo, JumpCloud

against: Oktaagainst: Active Directory Federation Services, Ping Identity, RSA SecurID

Perplexity SonarCisco Duo

Two alternatives

JumpCloud Protect, Microsoft Entra ID

against: privacyIDEACisco DuoHeld

Seven alternatives

Auth0, Clerk, Descope, JumpCloud Protect, Microsoft Authenticator, OneLogin, Stytch

Cisco Duo

Four alternatives

1Password, Google Authenticator, JumpCloud Protect, Microsoft Entra ID

Cisco Duo

Three alternatives

Google Authenticator, JumpCloud Protect, Microsoft Entra ID

no first choicenothing named

Grok 4.1 FastCisco Duo

Two alternatives

Microsoft Entra ID, Okta

Cisco DuoHeld

Three alternatives

JumpCloud, Microsoft Entra ID, Okta

Cisco Duo

Three alternatives

JumpCloud Protect, Microsoft Entra ID, Okta

against: LastPassCisco Duo

Six alternatives

Authelia, Authy, Google Authenticator, Keycloak, Microsoft Authenticator, privacyIDEA

no first choice

Five alternatives

Cisco Duo, Google Authenticator/Workspace, Microsoft Entra ID, Okta, YubiKey

against: Ripplingagainst: Microsoft Authenticator

Mistral SmallCisco Duo

Two alternatives

JumpCloud Protect, LastPass MFA

Cisco DuoHeld

Three alternatives

1Password, JumpCloud, LastPass

Cisco Duo, Microsoft Entra ID

Two alternatives

LastPass MFA, Okta

Google Authenticator, Microsoft Authenticator

One alternative

Cisco Duo

no first choicenothing named

DeepSeek V4 FlashCisco Duo, Microsoft Entra ID

One alternative

Okta

Microsoft Entra IDChanged

Two alternatives

Cisco Duo, Okta

Cisco Duo

Two alternatives

Microsoft Entra ID (Azure AD) / Microsoft Authenticator, YubiKey

against: Authy, Google Authenticator, OktaCisco Duo, Microsoft Entra ID

Two alternatives

Authy, Google Authenticator

against: YubiKeyCisco Duo, Microsoft Entra ID

Four alternatives

Okta, OneLogin, Rippling, YubiKey

nothing named

Llama 4 MaverickCisco Duo, Microsoft Entra IDLastPassChanged

Two alternatives

Cisco Duo, Microsoft Entra ID

Cisco Duo

Three alternatives

JumpCloud Protect, LastPass Authenticator, Microsoft Entra ID

against: Okta, Ping IdentityThinfinity Workspace

Three alternatives

Authy, Cisco Duo, Google Authenticator

Cisco Duo

Two alternatives

Microsoft Entra ID, Okta

nothing named

Qwen 3.7 FlashCisco Duo, Microsoft Entra ID

Two alternatives

Auth0, Google Cloud Identity

Cisco DuoChanged

Four alternatives

Authy, Google Prompt, Microsoft Authenticator, YubiKey

Cisco Duo, Microsoft Entra ID

One alternative

Google Identity-Aware Proxy / Google Workspace Advanced Protection

against: Authy, OktaCisco Duo

Two alternatives

Google Workspace 2-Step Verification, Microsoft Entra ID

against: Authy, Google Authenticator, Microsoft AuthenticatorMicrosoft

Five alternatives

Auth0, Clerk, Google Cloud, SentinelOne, Zscaler

against: Cisco Duoagainst: Google Authenticator, Microsoft Authenticator

Kimi K2Microsoft Entra ID

Three alternatives

Cisco Duo, JumpCloud Protect, Okta

Cisco Duo, Microsoft Entra IDChanged

One alternative

Okta

Cisco Duo

Two alternatives

JumpCloud, Microsoft Entra ID

against: Auth0, Okta, OneLoginMicrosoft Entra ID

Two alternatives

Cisco Duo, Google Authenticator

against: YubiKeyno first choice

One alternative

YubiKey

against: Auth0, Cisco Duo, Microsoft Entra ID, Okta

GLM 4.7 FlashXCisco Duo, Microsoft Entra ID

Three alternatives

LastPass, Okta, Rippling

Cisco DuoChanged

Three alternatives

LastPass MFA, Microsoft Entra ID, Okta

Cisco Duo, Microsoft Entra ID

Four alternatives

Auth0, Google Authenticator, JumpCloud Protect, Okta

Cisco Duo

Two alternatives

Auth0, Microsoft Entra ID

against: Google Authenticator, Microsoft Authenticator, Oktano first choiceagainst: Cisco Duo, Okta, Twilio Verify

MiniMax M2.5Cisco Duo, Microsoft Entra ID

One alternative

Okta

Microsoft Entra IDChanged

Two alternatives

Cisco Duo, LastPass

Cisco Duo, Google Authenticator

Three alternatives

JumpCloud, LastPass MFA, OneLogin

Google Authenticator, Microsoft Authenticator

Two alternatives

Cisco Duo, Okta

no first choicenothing named

Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record

Seventy-two rows: every prompt, every model, every answer.

Prompt	Model	Version string	Time (UTC)	Searched	Sources	Latency
Direct recommendation	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 14:13	yes	9	7 s
Direct recommendation	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 14:05	yes	3	7 s
Direct recommendation	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 11:42	yes	11	20 s
Direct recommendation	Perplexity Sonar	`sonar`	2026-09-17 12:43	yes	20	5 s
Direct recommendation	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 11:04	yes	11	10 s
Direct recommendation	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:19	yes	5	4 s
Direct recommendation	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 09:32	yes	12	16 s
Direct recommendation	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 11:12	yes	5	3 s
Direct recommendation	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 09:40	no	0	38 s
Direct recommendation	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 13:44	yes	9	21 s
Direct recommendation	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 12:48	yes	12	55 s
Direct recommendation	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 12:24	yes	20	51 s
Paraphrase	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 13:01	no	0	5 s
Paraphrase	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 09:24	yes	4	5 s
Paraphrase	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 09:36	yes	7	21 s
Paraphrase	Perplexity Sonar	`sonar`	2026-09-17 13:25	yes	16	6 s
Paraphrase	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 10:34	yes	13	8 s
Paraphrase	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 11:43	yes	5	4 s
Paraphrase	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 12:17	yes	8	16 s
Paraphrase	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 10:39	yes	5	3 s
Paraphrase	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 12:05	no	0	39 s
Paraphrase	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 12:07	yes	13	25 s
Paraphrase	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 14:04	yes	10	135 s
Paraphrase	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 10:45	yes	5	30 s
Comparative	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 11:51	yes	18	13 s
Comparative	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 14:14	yes	3	7 s
Comparative	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 12:54	yes	11	26 s
Comparative	Perplexity Sonar	`sonar`	2026-09-17 09:50	yes	20	8 s
Comparative	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 11:00	yes	40	18 s
Comparative	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:24	yes	5	7 s
Comparative	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 11:05	yes	18	23 s
Comparative	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 12:54	yes	5	3 s
Comparative	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 12:35	yes	5	23 s
Comparative	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 11:01	yes	15	43 s
Comparative	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 11:22	yes	7	113 s
Comparative	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 12:15	yes	5	24 s
Budget constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 12:32	no	0	5 s
Budget constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 13:25	yes	3	4 s
Budget constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 12:00	yes	13	26 s
Budget constrained	Perplexity Sonar	`sonar`	2026-09-17 13:47	yes	20	4 s
Budget constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 11:20	yes	18	10 s
Budget constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:21	yes	5	6 s
Budget constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 10:04	yes	9	12 s
Budget constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 12:19	yes	5	3 s
Budget constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 10:35	yes	5	27 s
Budget constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 12:20	yes	14	45 s
Budget constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 13:41	yes	19	263 s
Budget constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 11:32	no	0	11 s
Scale constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 12:13	no	0	10 s
Scale constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 10:05	no	0	7 s
Scale constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 12:44	no	0	15 s
Scale constrained	Perplexity Sonar	`sonar`	2026-09-17 11:32	yes	20	8 s
Scale constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 12:36	yes	15	10 s
Scale constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:54	no	0	6 s
Scale constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 10:25	yes	10	20 s
Scale constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 12:56	yes	5	5 s
Scale constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 14:03	no	0	40 s
Scale constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 10:19	yes	9	28 s
Scale constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 11:25	no	0	11 s
Scale constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 13:52	yes	5	16 s
Negative framing	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 12:48	yes	17	9 s
Negative framing	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 13:44	yes	4	5 s
Negative framing	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 12:23	yes	11	23 s
Negative framing	Perplexity Sonar	`sonar`	2026-09-17 11:25	yes	19	6 s
Negative framing	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 10:48	yes	17	13 s
Negative framing	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:15	yes	5	6 s
Negative framing	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 10:34	yes	17	20 s
Negative framing	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 09:35	yes	5	4 s
Negative framing	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 13:47	yes	14	52 s
Negative framing	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 12:14	yes	15	44 s
Negative framing	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 12:01	yes	27	30 s
Negative framing	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 11:55	yes	5	29 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings

Google Workspace read as Google Workspace 2-Step Verification

Okta Workforce Identity read as Okta

Unresolved, counted raw

Active Directory Federation Services

FIDO2

FIDO2 security keys

Google Identity-Aware Proxy / Google Workspace Advanced Protection

Google Prompt

LastPass Authenticator

Microsoft Entra security defaults + Microsoft Authenticator

OpenOTP/RCDevs

Discontinued, still offered

No shut-down product was recommended here.

Multi-factor authentication for small business buyers

By buyer segment

01The standing

Recommended versus criticized

02What they warned about

03What they cite

Sites the answers cite

Pages the answers cite

04How they answered

05The record

Normalization in this category

Also in identity and access