The first couple bullets are already woefully out of date. There is simply no reason for any company, startup or not, to not use passkeys or hardware security k

The first couple bullets are already woefully out of date. There is simply no reason for any company, startup or not, to not use passkeys or hardware security keys as the preferred method of account authentication. OTP are too easily phished. Our "order of preference" for account auth: 1. The primary employee auth system (we use Google Workspace which is common among startups, but this is certainly not a requirement) should be protected with passkeys (preferred) or as a U2F hardware key second factor. 2. For other SaaS products that your company uses, if they offer OAuth with your primary provider (and many/most do), use that. 3. If they don't, only then use a new password stored in an approved PW manager (which should obviously not be LastPass). The order of preference for second factor should be hardware key -> TOTP -> SMS 2FA based on what that provider allows.