The question is a bit open-ended. Basically, doing things like requiring complex passwords or 2FA prevents user accounts from being hacked. It does nothing for

The question is a bit open-ended. Basically, doing things like requiring complex passwords or 2FA prevents user accounts from being hacked. It does nothing for remote exploits in your application (like slack had recently). So for your end-users, there is no major onus to force them to 2FA. You can encourage it all you want, but at the end of a day, if an end user has their simple password brute forced, it's fixable. If you have 100k users with brute forced passwords, you might have to react, shut down accounts doing malicious activities, enforce complex passwords, etc. But the PIN data and service is still fine. Now, if we're talking employees that have access to sensitive data, then yes, I would definitely be all about enforcing 2FA.