By Jonathan Smith
I was asked a question recently that got me thinking:
“If there were only two things you could convince church leaders to do, what would they be?”
As I thought about it and looked back over the past several decades I’ve spent working in church IT, two things quickly rose to the top.
Honestly, neither of these should really be suggestions anymore; they should be requirements. Yet, somehow, here we are in 2026 still trying to convince churches and ministries that these are good ideas.
So, if I only get two, here they are.
#1: Enable two-factor authentication (2FA). Everywhere.
Yes, you read that correctly.
2FA.
It isn’t new. It isn’t exciting. I’m not going to get invited to give a TED Talk because I discovered it.
And yet, for many reasons, church leaders still struggle to implement two-factor or multifactor authentication across their organizations.
The irony is that as I write this, we are actively helping a client recover from a successful phishing attack that would have been stopped if 2FA had been enabled.
I understand the hurdles. Users don’t like change. Phones get replaced. Someone will inevitably say, “But I’ve never needed this before.”
Neither had the church that got compromised yesterday.
Every week we receive requests to help churches and ministries recover from losses that could have been prevented or dramatically reduced with 2FA. Sometimes the loss is data. Other times, we’re working to recover very significant amounts of money.
And yet, many organizations still won’t enable it.
Whatever your reason is for not enabling 2FA across every login your ministry uses, I lovingly implore you: get over it.
Find a partner who can help you enable it, support your users, and work through the inevitable hiccups. But it’s time to do it.
It would genuinely thrill my heart to go an entire week without encountering a preventable cyberattack where the bad actor got in because a church wouldn’t enable 2FA.
As I’ve said before, I believe we’re eventually going to have to use 2FA to get into heaven. Hopefully it uses biometrics, because I don’t plan on taking my phone with me.
Until then, though, everything should have 2FA enabled.
Is 2FA perfect? No. Nothing on Earth is.
But operating without it is like locking all the windows, leaving the front door wide open, and then acting surprised when someone walks in and takes the offering plate.
#2: Start implementing security awareness training
The most challenging component of any IT infrastructure to secure is usually sitting between the keyboard and the chair. Yes, that’s us.
We try to protect users with things like 2FA, but even then, people can be tricked into giving away their passwords, approving authentication prompts, or handing over security codes.
That’s why security awareness training, or SAT, isn’t optional anymore.
SAT should provide ongoing testing and education that keeps cybersecurity in front of your users.
Think of it as support and maintenance for your human firewall. You wouldn’t install a physical firewall, never update it, never monitor it, never maintain it, and then confidently announce, “We’re good forever.” (At least I hope you wouldn’t.) Your human firewall needs maintenance, too.
Doing this well usually means partnering with a vendor who specializes in security awareness training. Yes, there’s a cost. But here are some better questions:
How much is your reputation worth?
Or your donor data?
Or your payroll?
Or the trust your congregation has placed in you?
The key to effective security awareness training is that it needs to be ongoing. Security training isn’t a one-and-done event where everyone watches a video, answers five questions, gets a certificate, and returns to clicking links from “Micros0ft Support.” Testing and training need to be consistent.
When properly implemented, I’ve seen SAT take phishing-test failure rates from around 25% of a staff to 0.5%. More importantly, I’ve watched the culture change.
People start paying attention.
They start asking questions.
They report suspicious messages.
They warn one another.
Security stops being something “the IT people worry about” and starts becoming everyone’s responsibility.
Again, if this isn’t something you or your team are equipped to implement and manage, find a partner who can help. Put the training in place, measure the results, and keep improving.
Properly implemented SAT with measurable results might also help when working through cybersecurity insurance requirements.
Stop reading. Start acting.
There is a lot more I could say about both of these topics. But that’s actually part of the problem.
We don’t need another 1,000 words explaining why 2FA is a good idea.
We don’t need another conference session telling us that people click phishing emails.
We know.
It’s time to act.
Enable 2FA.
Train your people.
Measure the results.
Find a partner if you need help.
And be good stewards of the data, money, systems and confidence that have been entrusted to your ministry.
Here’s the uncomfortable question I’d leave every church leader with: How much money does your church have to lose before these recommendations stop being optional? $10,000? $100,000? More?
Because unfortunately, somewhere this week, another church will likely find out what its number is.
Again, I’d love to reach the point where we can go an entire week without hearing from a church in crisis because one of these two basic protections was still sitting on someone’s “we-should-probably-do-that-someday” list.
Don’t let your church be the next call.
2FA your accounts. Train your people. Start now.
Jonathan Smith is the president of MBS and the Chief Technology Officer at Faith Ministries in Lafayette, Ind. He is an author and frequent conference speaker. Follow him on X @JonathanESmith
