I worked for a Department of Energy national lab for 21 years, mostly doing computer work (data acquisition, parallel computing, building Linux-based supercomputers). I experienced the full arc of online threats. At the beginning (1994) folks still had to sign a pledge with ISPs not to use the internet for commercial use, there were few users, the WWW had only been around a couple of years, and authentication was simple password and/or the “r-utilities” (rsh, rlogin) which let a user on a one computer login to another mutually trusted computer with no further authentication.
By about the late 90s the lab had to switch everyone over to secure shell (ssh).
By the early 2000s the lab switched to Kerberos, with hardware dongles (“Cryptocards”, much later YubiKeys and the like) for access from unsecured devices. I recall spending about a week dealing with a security breach that involved a very bright physicist from Europe who exploited a university user with lab access who had an ssh private key without password protection, implanted a keystroke logger, sucked up Kerberos passwords, and proceeded to implant kernel exploits (root elevation) and keystroke loggers on the machines I administrated. This turned me into a hardware dongle fan for MFA, but they really are a pain.
Then came the explosion of phishing attacks. I did all my email for years in a text client that wouldn’t allow me to click on a link even if I wanted to. But eventually we all succumb to the convenience of “full service” email apps on phones and tablets.
Since I retired the lab switched to restricting email clients to Microsoft only (I won’t comment on the wisdom of this, considering some serious breaches came in the Microsoft universe) and hardware dongles for any financial- or business-related computing.
I finally just now took the plunge and ordered a pair of YubiKeys. MFA is the way, but I hate having multiple authentication apps on my iPhone, and where I live cell service isn’t very reliable so SMS messages can be delayed or dropped.