Check which accounts need 2FA.
Two-factor coverage is not one number but two. Overall coverage tells you how far through the backlog you are, while critical coverage — email, banking, password manager and cloud storage — is the figure that actually determines your exposure, because those accounts can be used to reset every other one. Prioritising by criticality rather than by convenience is what closes real risk fastest.
Coverage rates
Overall coverage = accounts with 2FA / total accounts x 100; critical coverage = protected critical accounts / critical accounts x 100
Remaining work
Critical gap = critical accounts - critical accounts protected
General guidance only, not a security assessment. Account protection needs depend on your threat model — follow your organisation's security policy for work accounts.
The email address used to reset everything else. An attacker holding your inbox can trigger password resets across every service that trusts it, so it is the single highest-value target.
They are far better than nothing but the weakest common option, because SIM swapping and interception both defeat them. An authenticator app or hardware key is stronger.