MFA and zero standing privilege are still the control gap in enterprise access

At a glance

What this is: This is an analysis of why enterprise access still breaks at the combination of password compromise, RDP exposure, and standing privilege, with MFA and zero standing privilege positioned as the control gap to close.

Why it matters: For IAM, PAM, and NHI teams, the issue is that access risk is not just authentication failure but the persistence of usable privilege after entry, which changes how you design containment and monitoring.

Context

MFA and zero standing privilege are access-governance controls that aim to stop valid credentials from becoming durable attacker access. The article frames the problem around enterprise environments where passwords, RDP, and persistent privilege still create open paths after initial compromise.

For identity programmes, the gap is not only whether users can authenticate, but whether access remains continuously available once authentication succeeds. That distinction matters for human users, service access patterns, and any environment where a stolen credential can be used to move laterally before detection.

Key questions

Q: What breaks when MFA is not enforced on every remote access path?

A: When MFA is inconsistent, a stolen password can still function as a valid enterprise login, which gives attackers a low-friction entry point into critical systems. That failure is especially dangerous in legacy portals and hybrid environments, where exceptions often persist longest and are hardest to audit.

Q: Why do standing privileges increase the impact of credential theft?

A: Because the attacker inherits whatever access is already attached to the compromised identity, including permissions that exceed the current task. Persistent access extends the window for misuse and gives the attacker broader lateral movement options. Reducing that window is what makes JIT more than a convenience control.

Q: What are the signs that enterprise remote access is failing?

A: Watch for RDP use from unusual sources, logins that bypass normal approval paths, and identity activity that expands into directory or administrative functions soon after authentication. Those patterns suggest remote access is acting as an attacker corridor rather than a controlled admin channel. Correlated telemetry is what exposes that shift.

Q: What should teams prioritise first, MFA or zero standing privilege?

A: They should implement both, but the priority order depends on the current exposure. If remote access and stolen credentials are the main path in, MFA should be immediate. If privileged accounts are already broadly reusable, zero standing privilege may reduce risk faster because it removes the access attackers want after they authenticate.

Technical breakdown

Why valid credentials still become an access path

Once an attacker has a working username and password, they are no longer forcing entry, they are operating inside the trust boundary the organisation already created. MFA adds a second challenge at authentication time, but it does not by itself remove standing access, persistent sessions, or overbroad entitlements. That is why compromised credentials remain so useful: the attacker is borrowing real identity context rather than breaking perimeter controls. In practice, the weak point is not only authentication strength but how long access stays usable after it is issued. Practical implication: treat credential compromise as an access-governance problem, not only a login problem.

Practical implication: map which identities still offer durable access after authentication and prioritise those for MFA plus privilege reduction.

How RDP and active directory expand blast radius

RDP is valuable because it gives remote administrative reach, which is also why it is attractive to attackers once they have credentials. Active Directory sits at the centre of enterprise authorisation, so abuse there can cascade into broader privilege changes, new sessions, and lateral movement across systems. The article’s core point is that remote access and directory control amplify the value of a single credential set. If those paths are exposed with weak monitoring, an attacker can move from initial access to broader control before defenders see enough telemetry to intervene. Practical implication: restrict remote administration paths and watch for identity changes that precede expansion of access.

Practical implication: reduce the number of identities and paths that can reach remote administration and directory-control functions.

Why telemetry matters after authentication succeeds

Telemetry is the evidence layer that tells defenders whether access is being used normally or abusively. The article links reduced dwell time to the need for faster detection, which means alerts only help if identity, session, and system activity can be correlated quickly enough to expose suspicious access patterns. MFA may block some reuse of stolen passwords, but telemetry is what reveals whether an attacker is probing for alternate paths, testing RDP, or attempting lateral movement. Without usable telemetry, enterprises see the login but not the progression that follows it. Practical implication: align identity logs, remote access logs, and directory events so suspicious access can be acted on while it is still active.

Practical implication: correlate authentication, session, and directory events so abusive access is visible before it expands.

Threat narrative

Attacker objective: The attacker aims to turn one stolen credential into broader internal access and a larger blast radius before defenders can detect and contain the session.

1. Entry begins when an attacker obtains valid credentials through phishing, brute force, or social engineering and uses them to authenticate into the enterprise.
2. Escalation follows when the attacker leverages RDP or directory reach to test adjacent systems, expand privilege, and move laterally.
3. Impact occurs when persistent access and weak telemetry let the attacker operate long enough to manipulate privileges, reach critical systems, or cause broader compromise.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Persistent access, not password theft alone, is the enterprise control gap. The article is right to focus on MFA and zero standing privilege because modern access failures are rarely about a single bad password in isolation. The real problem is that once access exists, many enterprises still let it persist long enough to be reused, escalated, or hidden inside routine activity. That makes blast radius a governance outcome, not just a breach outcome.

Standing privilege is the assumption that collapses first. Access reviews and periodic checks assume privilege remains stable and observable long enough to govern after issuance. In environments with exposed RDP, shared admin paths, and live directory control, that assumption breaks because access can be exercised immediately and at scale. The implication is that identity programmes must stop treating persistence as a default state.

MFA everywhere is necessary but not sufficient without session and path control. MFA reduces credential replay, but it does not by itself govern where an authenticated identity can go or how long it can remain effective. If remote access routes and directory privileges stay broad, the attacker still has a usable path after the first login challenge. Practitioners should treat MFA as one control in a containment chain, not as the chain itself.

Identity blast radius is the concept this article surfaces most clearly. The enterprise access problem is no longer whether an account can be authenticated, but how much infrastructure becomes reachable after that point. Once access is persistent and poorly observed, the security question shifts from prevention to containment. Practitioners should design for minimal reachable scope, not merely successful sign-in.

Telemetry is the control plane for proving access misuse in time. The article’s dwell-time framing points to a broader governance issue: if defenders cannot correlate identity and system activity quickly, they are operating blind after authentication. That leaves analysts reacting to symptoms instead of interrupting the progression of abuse. Teams should treat identity telemetry as an operational requirement, not an audit afterthought.

From our research library:

• 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.

What this signals

Identity programmes need to measure post-login reach, not just authentication success. A user who can sign in is not yet contained if the same identity can still reach admin tools, remote desktop, and directory control. The governance question shifts to how much action remains available after the second factor is satisfied.

Privilege persistence is the part of enterprise access most teams under-model. MFA addresses one failure point, but the article shows that blast radius is decided by what stays usable after login. That means access design, session scope, and remote administration policy must be evaluated together rather than as separate controls.

For practitioners

• Enforce MFA across all access paths Require MFA for email, admin consoles, remote access, and any session that can reach production assets. Do not leave legacy or exception paths outside the policy scope.
• Eliminate standing privilege for administrative access Replace persistent elevated access with just-in-time privilege so admin rights exist only for the task and session that needs them.
• Lock down RDP as a privileged entry path Limit RDP to approved jump paths, narrow who can use it, and monitor every successful remote session as a high-risk event.
• Correlate identity and session telemetry Join authentication, directory, and remote session logs so suspicious post-login activity can be identified before lateral movement completes.

Key takeaways

• The central risk is not only stolen credentials, but the persistent access they unlock when MFA coverage and privilege scope are uneven.
• The article ties enterprise exposure to repeated patterns such as RDP abuse, lateral movement, and weak telemetry rather than to one isolated authentication failure.
• Reducing blast radius requires task-scoped privilege, broad MFA enforcement, and visibility into post-login activity, not just stronger passwords.

Key terms

• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
• Multi-Factor Authentication: Multi-factor authentication requires two or more independent verification factors before access is granted. In practice, it reduces the chance that a stolen password alone will open a system, but it only works well when applied consistently across all high-risk access paths and identity types.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Identity Telemetry: Identity telemetry is the collection of signals generated by authentication, session, and access events across human and non-human identities. It becomes useful for governance when teams can baseline normal behavior and detect drift in source, privilege, or access frequency.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.