MFA coverage gaps are now a compliance and insurance risk

At a glance

What this is: This is an analysis of how incomplete MFA coverage is shifting from a security gap into a compliance, audit, and insurance problem.

Why it matters: IAM, PAM, and NHI teams need provable MFA enforcement because missing coverage now affects regulator expectations, insurer decisions, and breach response outcomes across the identity surface.

By the numbers:

• 2 in 5 of these accounts are missing MFA, according to Push Security.
• A 1,000 user organization has over 15,000 accounts with various configurations and associated vulnerabilities, according to Push Security.

Context

MFA coverage is only useful when it is enforced across the actual places users authenticate, not just where policy says it exists. In practice, browser-based logins, SaaS access paths, and inconsistent app integrations leave gaps that security teams do not always see until an incident or audit exposes them.

That gap now matters because compliance, insurer scrutiny, and evidence requirements are converging on the same question: can an organisation prove where MFA is required, where it is missing, and where exceptions still exist? For IAM programmes, the issue is visibility into enforcement rather than mere deployment.

Key questions

Q: What breaks when MFA is not enforced on every remote access path?

A: When MFA is inconsistent, a stolen password can still function as a valid enterprise login, which gives attackers a low-friction entry point into critical systems. That failure is especially dangerous in legacy portals and hybrid environments, where exceptions often persist longest and are hardest to audit.

Q: Why do missing MFA controls create both breach and insurance risk?

A: Missing MFA increases the chance that stolen credentials or browser-based attacks will succeed, but it also creates a governance problem after the fact. If an organisation attested that MFA was in place and later cannot prove it, insurers may dispute coverage and auditors may treat the control as ineffective.

Q: What are the signs that MFA coverage is incomplete?

A: The clearest signs are inconsistent enforcement across SaaS apps, legacy accounts that bypass MFA, browser logins that do not trigger the expected challenge, and policy statements that do not match sign-in evidence. Those gaps usually surface during audits or post-breach investigations.

Q: Should organisations treat MFA as part of compliance, access governance or user experience?

A: They should treat it as all three, but governance should lead. MFA supports compliance evidence, improves remote access assurance and can reduce friction when designed well. The mistake is optimising only for convenience or only for audit, because either approach can weaken the actual security outcome.

Technical breakdown

Why MFA deployment and MFA enforcement are not the same

MFA deployment means a control exists somewhere in the stack. MFA enforcement means the control is applied consistently at every access point that matters, including browser-based SaaS logins, remote access, and administrative paths. Modern environments make this distinction critical because identity is now the main route into business systems, while configuration drift, app-specific exceptions, and unmanaged accounts create pockets where logins bypass the intended challenge. The result is not a missing product but an incomplete control plane. Auditors and insurers increasingly care about the control as experienced by the attacker, not the policy statement on paper.

Practical implication: measure MFA at the access-path level, not the policy level.

How insurers and regulators interpret MFA gaps

Insurance and compliance reviews increasingly treat MFA as an evidentiary control. If a policy claims MFA coverage but the actual login path does not enforce it, the issue becomes misrepresentation, not just weak security. That distinction explains why missing MFA can lead to denied claims, fines, and audit findings even when a programme believed it had coverage. Frameworks such as PCI DSS v4.0 and NYDFS 500 make the expectation explicit, while HIPAA, GDPR, and ISO/IEC 27001 can still produce enforcement through broader language around reasonable safeguards and appropriate technical measures. The pattern is consistent: proof matters as much as implementation.

Practical implication: retain evidence that proves MFA enforcement for each in-scope access path.

Why browser-based identity attacks change the MFA baseline

Browser-mediated access has expanded the attack surface beyond the traditional network boundary. Attackers no longer need to defeat the perimeter if they can target the user session, the browser flow, or a SaaS login path that lacks strong authentication. That makes MFA coverage gaps more dangerous, because a missing challenge on even one exposed app can become the entry point for credential stuffing, phishing, or session theft. In identity terms, the control boundary has shifted from the office network to the authentication flow itself. Organisations that still think in local-network terms will systematically undercount exposure.

Practical implication: include browser-originated SaaS access in MFA scope reviews and exception tracking.

Threat narrative

Attacker objective: The attacker wants to gain usable account access through the weakest authentication path and then expand into business systems or data.

1. Entry occurs when attackers target SaaS logins and browser-based access paths that do not enforce MFA.
2. Credential abuse succeeds when stolen or weak passwords meet accounts missing MFA, allowing access without a second factor.
3. Impact follows when those gaps enable compromise of business systems, data exposure, or ransomware entry through the identity plane.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MFA coverage gaps are now a control evidence problem, not just an authentication problem. The market has moved from asking whether MFA exists to asking whether it is enforced on every relevant access path and provable under audit. That changes the governance burden for IAM, PAM, and security assurance teams because the control must be demonstrable across the modern identity surface. The practical conclusion is that enforcement evidence now sits alongside policy design as a core control objective.

Browser-based access has turned the identity layer into the primary attack surface. As SaaS adoption pushes work into web sessions, the old network boundary matters less than the login flow itself. That means MFA exceptions on a handful of apps can create disproportionate risk because attackers need only one reachable path. Practitioners should treat browser-originated authentication as part of core security architecture, not a side channel.

Compliance language is converging on the same outcome even when the wording differs. PCI DSS v4.0 is explicit, while HIPAA, GDPR, ISO/IEC 27001, and related regimes arrive there through broader expectations for appropriate safeguards and technical measures. This is where identity governance becomes evidence governance: if coverage cannot be shown, the control is treated as incomplete. The implication is that teams must manage MFA as a measurable compliance asset, not an assumed baseline.

Insurance underwriting is effectively becoming a second control validation layer. If an organisation attests to MFA coverage that later proves false, the issue can shift from incident cost to coverage denial. That means the identity programme now influences financial resilience as well as cyber resilience. Security leaders should understand that MFA exceptions, stale app inventories, and undocumented authentication paths can become claims disputes, not just audit findings.

Missing MFA is exposing an identity coverage gap across thousands of accounts, not a single policy failure. The scale of the problem makes completeness the decisive variable, because attackers only need one unprotected access path. Organisations should therefore frame MFA governance as a coverage-management discipline: inventory, enforce, prove, and continuously reconcile.

What this signals

MFA coverage has become a governance metric, not just an access control. Security teams need to know where challenge enforcement exists, where it is bypassed, and where evidence can prove the difference. The programmes that win here will manage authentication coverage the way they manage asset inventory: continuously and with exception handling.

Coverage gaps will keep widening in browser-centric environments unless identity teams align enforcement with real user behaviour. SaaS logins, contractor access, and app-specific exceptions create practical blind spots that policy documents do not eliminate. The operational question is whether your IAM programme can show complete enforcement across the sessions users actually use.

For practitioners

• Map MFA enforcement at the access-path level Inventory every browser-based and remote access route into business systems, then verify where MFA is actually enforced rather than assumed from policy. Include SaaS applications, administrative access, contractor paths, and exception routes.
• Close exception-driven MFA blind spots Review app-by-app MFA exceptions, legacy accounts, and shadow access routes that bypass the standard challenge flow. Prioritise the paths that connect directly to sensitive data or administrative functions.
• Preserve evidence for audits and insurers Keep logs, policy exports, and enforcement reports that show MFA coverage by system, user population, and access method. Treat this evidence as part of the control itself, not an after-the-fact artefact.
• Tighten controls around browser-originated sessions Monitor sign-in patterns, session hijack indicators, and vulnerable password use across browser sessions that reach SaaS applications. Use those signals to prioritize remediation before attackers exploit the weakest login path.

Key takeaways

• MFA gaps now create a combined security, compliance, and insurance problem because enforcement matters as much as policy intent.
• The article points to real-world evidence that missing coverage can lead to penalties, denied claims, and broader incident exposure.
• Identity teams should manage MFA as a provable coverage control across the full access surface, not as a static checkbox.

Key terms

• MFA Coverage: MFA coverage is the extent to which multi-factor authentication is enforced across systems, users, and access paths. In a regulated environment, partial coverage leaves control gaps that can undermine access security and compliance. High-quality coverage means the requirement is applied consistently and can be evidenced in audits.
• Authorization Enforcement: Authorization enforcement is the control that decides whether a tool call is allowed to run. In an MCP environment, it should evaluate the agent, the acting user, the tool, and the arguments before execution. This keeps access decisions external to the server and supports fail-closed operation.
• Coverage Gap: A coverage gap is the space between what an access control programme claims to manage and what it actually governs in production. In PAM, this often appears when new resource types, teams, or protocols require exceptions, manual handling, or separate tooling, leaving important privileged pathways outside policy consistency.
• Browser Attack Surface: The browser attack surface is the collection of ways web content, extensions, scripts, and session material can be abused on the client side. For AI services, it includes authenticated pages, extension permissions, and any code that can observe or modify runtime behaviour.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.