MFA blind spots expose why coverage is not the same as control

At a glance

What this is: This article argues that MFA can look complete on paper while leaving legacy, remote and privileged access paths weakly enforced.

Why it matters: IAM teams need to treat enforcement coverage, not checkbox deployment, as the real control objective across human, NHI and privileged access.

Context

MFA blind spots appear when the control exists in some places but not in the systems attackers actually use. In practice, coverage gaps around legacy applications, remote access, shared accounts and break-glass workflows create a false sense of protection.

For identity programmes, the issue is not whether MFA has been deployed somewhere in the estate. The question is whether it is enforced consistently across every path to access, including endpoints, privileged workflows and systems that still depend on passwords.

Key questions

Q: What breaks when MFA is used only at sign-in and not for privileged actions?

A: The main failure is stale trust. A user may authenticate once and then remain authorized for hours or days, which is too broad for account deletion, payment approval, or access to secrets. Without re-authentication at the point of action, an attacker who inherits the session can complete high-risk operations without facing a fresh challenge.

Q: Why do phish kits create so much risk for organisations even when MFA is in place?

A: Phish kits increase risk because they can steal both passwords and valid MFA or OAuth tokens before those tokens expire. That lets an attacker authenticate as the user instead of replaying a guessed password. Kits also mimic real branding, collect device and location signals, and can redirect victims to a legitimate login page, which lowers suspicion and extends attacker dwell time.

Q: What signs show that MFA enforcement is weaker than policy says?

A: Look for shared admin accounts, legacy apps outside SSO, permanent exceptions, passwords still used at endpoints and different login flows across systems. Those signals usually mean the organisation has coverage gaps, not just implementation noise. If the user experience and policy differ by system, enforcement is probably inconsistent.

Q: How should teams handle access when MFA infrastructure is unavailable?

A: They should predefine the failure state before it happens, then test it. If a control outage causes the system to default to open access, that is a design defect, not resilience. High-assurance environments need offline validation or tightly governed local fallback paths, with clear ownership and review.

Technical breakdown

Why MFA coverage fails in mixed estates

MFA coverage is often strongest where identity platforms are modern, federated and centrally managed, such as SaaS environments. It weakens when organisations must support legacy applications, VPN-based access, RDP, SSH and endpoint logins that were designed around passwords or inconsistent policy enforcement. The technical problem is not the existence of MFA, but the fragmentation of authentication paths. Once one path remains password-based, attackers will target the weakest enforcement point rather than the strongest one.

Practical implication: Map every authentication path in the estate and treat the weakest path as the real control boundary.

Why phishable factors are still a control gap

Not every second factor materially changes attacker effort. SMS codes, OTP apps and push approvals can all be abused through phishing proxy attacks, SIM swapping or push fatigue. These methods still depend on user interaction and often preserve password dependence as the first factor. That means an organisation can satisfy a policy requirement while remaining vulnerable to credential capture and session takeover. The security outcome depends on resistance to real attack techniques, not just the presence of a second step.

Practical implication: Prioritise phishing-resistant methods where the login path is exposed to adversary-in-the-middle attacks.

Privileged workflows need stronger enforcement than normal users

Privileged access breaks the usual assumption that administrators can be protected by the same authentication pattern as general users. Shared admin accounts, temporary exceptions and break-glass workflows often bypass normal MFA policy, especially when operational convenience is allowed to override governance. That creates a high-impact gap because privileged users do not need to escalate after login. If the authentication control is inconsistent at the admin layer, the resulting compromise already starts at elevated access.

Practical implication: Apply stricter enforcement and exception governance to admin and break-glass paths than to standard user logins.

Threat narrative

Attacker objective: The attacker wants to obtain durable legitimate access through the weakest authentication path and use it to move as a trusted user.

1. Entry begins when an attacker uses a path that is nominally protected by MFA but is either legacy, exempted or phishable.
2. Credential access follows when the attacker captures a password, OTP or approval flow that does not resist modern phishing techniques.
3. Escalation occurs when the compromised login is a privileged or remote-access path that already grants high-trust access.
4. Impact is achieved through legitimate-looking access that lets the attacker operate as an authenticated user inside the environment.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Coverage is not control when authentication enforcement is fragmented. A programme can claim MFA deployment and still leave the most dangerous paths exposed if legacy systems, remote access and privileged workflows are exempted. The control only exists where it is enforced consistently, which is why governance has to focus on path coverage, not policy statements. Practitioners should treat incomplete enforcement as a structural identity risk, not an implementation detail.

Phishing resistance is the difference between policy compliance and attack resistance. OTPs, SMS and push approval can satisfy a checklist while still allowing adversary-in-the-middle compromise. In regulated environments, that gap matters because the control objective is to block credential replay and session hijack, not simply add a second prompt. Security teams need to recognise that second-factor presence does not equal resistance to credential theft.

Shared admin access and break-glass paths expose the exception debt in identity programmes. The article highlights a named concept we call MFA exception debt: every temporary workaround for legacy access, admin convenience or recovery eventually becomes part of the attack surface. Once those exceptions accumulate, the identity programme becomes hardest to trust exactly where the impact is highest. The practical conclusion is that exception governance is an access control problem, not an administrative one.

Endpoint authentication still proves how dependent the estate is on passwords. Even where the user experience looks modern, many desktop logins still rely on a password underneath. That means organisations can modernise the front end while leaving the first factor intact, which preserves phishing and reuse risk across the estate. Practitioners should treat endpoint login as part of identity architecture, not a separate usability layer.

MFA blind spots are increasingly an auditability problem as much as a security problem. If a team cannot prove where MFA is enforced, which methods are used and where exceptions exist, it cannot show that access is actually governed. That shifts the discussion from assurance theatre to evidence quality. Identity leaders should expect auditors and incident responders to ask for proof at the path level, not a generic policy statement.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Read next: MFA Guide

What this signals

MFA exception debt: the more legacy systems, remote access routes and admin workarounds an organisation accumulates, the less meaningful its MFA claim becomes. Teams should expect the weakest authenticated path to define the real security boundary, not the policy that appears in the GRC register.

The practical test is simple: if you cannot prove which systems are covered, which factors are used and where passwords still anchor access, then MFA is still behaving like a partial control. That is especially important for privileged access, where a single gap can negate the rest of the programme.

For practitioners

• Map authentication enforcement by access path Inventory SaaS, legacy applications, VPN, RDP, SSH, endpoint login, shared admin accounts and break-glass workflows, then record where MFA is enforced, bypassed or absent.
• Replace phishable factors on exposed paths Prioritise phishing-resistant authentication for remote access, privileged workflows and any login path reachable from the internet or a user-controlled device.
• Control exceptions as expiring access debt Require business justification, owner approval and expiry dates for every MFA exception, with regular review of whether the exception still reflects operational need.
• Separate admin enforcement from user enforcement Apply tighter authentication requirements to privileged accounts, including shared admin workflows and emergency access, rather than inheriting the standard user policy.
• Prove enforcement under audit and incident review Capture logs and configuration evidence that show where MFA is active, which factor types are in use and which systems remain outside the enforced boundary.

Key takeaways

• MFA creates a false sense of coverage when legacy systems, remote access and privileged workflows remain outside consistent enforcement.
• The real risk is not authentication presence but authentication path weakness, especially where phishable factors or exceptions remain in use.
• Identity teams should govern MFA as a path-level control, with proof of enforcement, tighter admin rules and explicit exception expiry.

Key terms

• MFA Coverage: MFA coverage is the extent to which multi-factor authentication is enforced across systems, users, and access paths. In a regulated environment, partial coverage leaves control gaps that can undermine access security and compliance. High-quality coverage means the requirement is applied consistently and can be evidenced in audits.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Break-glass Access: Break-glass access is an emergency path that bypasses normal access controls when standard authentication fails or a critical incident demands immediate intervention. It must be tightly time-bound, logged, and reviewed, because it exists to restore operations without becoming a permanent back door.
• MFA Exception Debt: The accumulation of temporary MFA workarounds that gradually become permanent parts of the access landscape. This debt matters because every exception expands the attack surface, weakens auditability and shifts the real security boundary away from policy toward whatever remains unenforced.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.