TL;DR: Traditional MFA is strongest at login, but attacker activity increasingly escalates through trusted internal paths such as admin protocols, legacy systems, and overprivileged service accounts. Zero Networks’ analysis says identity now drives nearly 90% of incidents, while MFA adoption in large enterprises averages 87%. The gap is internal reach, not authentication alone.
At a glance
What this is: This is an analysis of why MFA at the login boundary still leaves internal identity pathways open, with service accounts and admin protocols carrying most of the remaining risk.
Why it matters: It matters because IAM and NHI programmes can overestimate MFA coverage if they do not also govern internal reach, protocol access, and machine identity scope.
By the numbers:
- Identity now plays a material role in nearly 90% of cyber incidents, according to Zero Networks.
- MFA adoption rates now average 87% in large enterprises, according to Zero Networks.
- Just 2.6% of workload identity permissions are actually used, according to Zero Networks.
- 51% of workload identities are completely inactive, according to Zero Networks.
Context
MFA is an entry control, not a complete identity boundary. The governance gap appears when organisations treat authenticated login as equivalent to safe internal movement, even though attackers often exploit trusted paths after the first session is established.
For IAM and NHI programmes, the real question is no longer whether users authenticate with MFA. It is whether service accounts, admin protocols, machine-to-machine calls, and legacy systems are governed once access moves inside the network.
Key questions
Q: What breaks when MFA is used only at sign-in and not for privileged actions?
A: The main failure is stale trust. A user may authenticate once and then remain authorized for hours or days, which is too broad for account deletion, payment approval, or access to secrets. Without re-authentication at the point of action, an attacker who inherits the session can complete high-risk operations without facing a fresh challenge.
Q: Why do service accounts create risk even when MFA adoption is high?
A: Service accounts often bypass human authentication workflows and retain broad, persistent access that MFA does not meaningfully govern. If those identities can reach many systems or protocols, an attacker who compromises them can move laterally without needing another login challenge. High MFA adoption does not fix that exposure.
Q: How should security teams implement JIT for privileged access?
A: Security teams should implement JIT at the permission layer, not only at the session layer. That means granting the exact entitlement needed for the task, limiting the duration, and removing the right from the target system automatically. A broker alone is not enough if static permissions remain behind it.
Q: What is the difference between application-layer MFA and network-layer MFA?
A: Application-layer MFA verifies entry to a service, while network-layer MFA can verify access closer to the protocol or path being used inside the environment. The first protects sign-in, but the second helps govern internal reach where lateral movement actually happens.
Technical breakdown
Why MFA at the application layer leaves internal protocols open
Traditional MFA is usually enforced at the application edge, such as portals, VPNs, and cloud logins. That works for entry, but it does not govern what happens after the session is established. Admin protocols like SMB, RDP, WinRM, and RPC operate as trusted internal transport paths, so an attacker with valid credentials can move without re-entering the same authentication boundary. The architectural failure is assuming the login event is the control point that matters most. In practice, identity risk shifts from access initiation to reachability inside the network, where application-layer MFA has little visibility.
Practical implication: treat MFA as one layer in a wider internal access model, not as proof that lateral movement is constrained.
Why service accounts and machine identities widen the trust gap
Service accounts, API tokens, and other machine identities often hold broad permissions because they were created for operational convenience rather than scoped governance. The article notes that machine identities now make up more than 70% of networked identities, which means the attack surface is no longer dominated by humans. These identities rarely face interactive MFA challenges, yet they can connect to sensitive systems continuously and at machine speed. That creates a trust model built on persistence, not verification, and it is exactly where overprivilege becomes operationally useful to an attacker.
Practical implication: scope machine identities to the minimum systems and protocols they actually need, then review them as production access subjects rather than background plumbing.
Why standing privilege, not just weak authentication, drives breach expansion
The decisive control failure is often standing privilege. If access remains permanently available, stolen credentials, compromised service accounts, or ordinary internal trust can turn a small foothold into broad reach. The article’s logic is that blast radius is controlled less by how hard it is to log in and more by how much can be touched after login. Just-in-time access changes the privilege model by making elevation temporary and purpose-bound, while network-layer MFA extends verification closer to the protocol itself. That combination addresses the internal escalation path conventional MFA leaves untouched.
Practical implication: design for temporary privilege and protocol-aware verification, especially around administrative and legacy access paths.
Threat narrative
Attacker objective: The attacker’s objective is to convert one trusted login into broad internal reach and high-impact compromise without needing to defeat MFA repeatedly.
- Entry often begins with valid credentials or another trusted login path rather than a novel exploit, so the first boundary is commonly already crossed cleanly.
- Escalation follows through admin protocols and overprivileged service accounts, where internal trust allows movement beyond the original access scope.
- Impact occurs when a single compromised system or identity opens access to much of the environment, turning authentication into a lateral-movement enabler.
Breaches seen in the wild
- Kubeflow cryptomining attacks 2020: Exposed Kubeflow dashboards and a notebook's mounted Kubernetes service account let attackers run cryptominers on tens of ML clusters.
- Storm-0501 hybrid cloud attacks 2024: Ransomware affiliate Storm-0501 stole Entra Connect Sync credentials to move from on-prem AD to Entra ID, then forged tokens via a rogue federated domain.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Internal reach, not login success, is the real identity control boundary: MFA at the edge can still leave the network wide open if protocols, service accounts, and legacy systems remain implicitly trusted. That means the security question has shifted from whether a session was verified to whether anything meaningful can still be reached after verification. For identity programmes, the practical conclusion is that authentication and reachability must be governed together.
Machine identity sprawl is now the structural blind spot in MFA-first programmes: When service accounts and API tokens represent the majority of networked identities, human MFA coverage no longer describes the attack surface. These identities operate continuously, often with permissions they barely use, so their risk profile is defined by scope and persistence rather than user challenge flows. The implication is that NHI governance has to become an internal access discipline, not just a secrets exercise.
Standing privilege creates the breach window that MFA cannot close: Traditional MFA reduces friction at entry, but it does not remove the always-on access state that attackers exploit after compromise. This is the assumption that breaks: least privilege is being treated as a login property when it is really a reachability property. Practitioners should read that as a warning that privilege must be time-bound and protocol-aware if it is to matter inside the network.
Network-layer verification changes the unit of control from session to path: The article’s core message is that control needs to move closer to SMB, RDP, WinRM, RPC, and other internal pathways. That is a different governance model from app-level MFA because it governs where an identity can go, not just whether it can enter. For identity security programmes, that is a stronger signal that internal trust is now the category problem.
Ephemeral access scope: Access that expires automatically and is constrained to a specific task is becoming the baseline control expectation for privileged identities. Where that scope remains permanent, blast radius becomes a design choice rather than an accident. The practitioner implication is to treat persistent reach as an exception that requires explicit justification.
From our research library:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Service Account Security Guide
What this signals
Microsegmentation is now inseparable from identity governance: if an authenticated session can still reach many systems, then MFA has not reduced exposure in any meaningful way. The programme question shifts to whether internal paths are closed by default, because that is where blast radius is actually constrained.
Service account governance has to move upstream of authentication policy: identity teams should review whether machine identities are still carrying standing reach that no human operator could justify. When unused permissions persist, the issue is not login assurance but unmanaged internal authority.
Layering access controls onto protocols is becoming the practical test of maturity: teams that only measure MFA coverage will miss the larger question of whether RDP, SMB, WinRM, and RPC are still open highways. The next maturity step is to align identity policy with internal path control, not just with portal sign-in.
For practitioners
- Map internal trust paths Inventory which admin protocols, service accounts, and legacy systems remain reachable after login, then classify those pathways by blast radius rather than by application ownership.
- Scope service accounts to observed behavior Restrict machine identities to the minimum systems and protocols required for their actual operational role, and review any unused permissions as governance drift.
- Replace standing privilege with JIT access Move privileged access from persistent grants to time-bound, purpose-bound elevation so that administrative reach disappears when the task is complete.
- Extend verification to internal protocols Apply verification controls to RDP, SMB, WinRM, RPC, and similar paths so authentication is enforced at the point of internal access, not only at the application edge.
Key takeaways
- MFA reduces one class of risk, but it does not stop lateral movement once attackers are inside the network.
- Service accounts and legacy protocols remain the critical blind spots because they preserve internal trust after authentication.
- The control shift is from verifying login to constraining reach, using microsegmentation, JIT access, and protocol-level enforcement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on excessive internal reach held by service accounts and machine identities. |
| NHI-07 — Long-Lived Secrets | Persistent access grants and always-on privilege are the article's core exposure pattern. | |
| Recommendation — Reduce machine identity reach to the minimum systems and protocols required for operation. Replace standing machine access with time-bound grants that expire automatically. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The analysis is fundamentally about internal authorisation scope after authentication. |
| Recommendation — Review entitlements so authenticated access cannot exceed operational need inside the network. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article argues that excessive internal permissions, not login weakness alone, drive breach spread. |
| Recommendation — Apply least privilege to protocol access, service accounts, and administrative reach. | ||
| MITRE ATT&CK | TA0008 — Lateral Movement | The article's main threat path is movement through trusted internal protocols after initial access. |
| Recommendation — Map internal protocol exposure to lateral movement paths and harden the highest-trust corridors. | ||
| CIS Controls v8 | CIS-5 — Account Management | Service account sprawl and unused permissions are central to the control gap described. |
| Recommendation — Inventory and remove stale account access that creates hidden internal reach. | ||
Key terms
- Network-layer MFA: A verification approach that applies multi-factor checks closer to the network path than the application login screen. It matters because authentication can succeed while internal reach remains open, so the control must govern protocol access as well as sign-in.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
- Service Account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org