MFA everywhere still leaves service accounts and protocols exposed

At a glance

What this is: This is an analysis of why perimeter-style MFA leaves major identity gaps in service accounts, admin protocols, legacy apps, and internal lateral movement.

Why it matters: It matters because IAM, PAM, and NHI programmes still fail if they secure entry points but leave internal trust, machine identities, and privileged pathways ungoverned.

By the numbers:

• Identity has become the primary attack surface, playing a material role in nearly 90% of cyber incidents.
• MFA adoption rates now average 87% in large enterprises.
• 71% of threat activity flows through four admin protocols: SMB, RDP, WinRM, and RPC.
• A single compromised system gives attackers access to 85% of the environment in one hop.

👉 Read Zero Networks' analysis of why MFA everywhere still misses internal identity gaps

Context

MFA protects the authentication moment, but it does not by itself control what authenticated identities can reach once they are inside the environment. That distinction matters for identity security programmes because many real attacks no longer rely on bypassing login, they rely on moving laterally through trusted internal systems, admin protocols, and machine-to-machine pathways.

The strongest version of the problem is not human sign-in at the edge. It is the accumulation of standing privilege, exposed service accounts, and legacy systems that cannot participate in modern authentication flows. In practice, MFA at the portal can coexist with wide internal reach, which leaves IAM, PAM, and NHI governance misaligned with how attackers actually operate.

For identity teams, this is a governance problem as much as a control problem. If reachability is not constrained after authentication, the environment still behaves as though internal trust is free, even when MFA coverage looks high on paper.

Key questions

Q: How should security teams limit lateral movement after MFA login succeeds?

A: Security teams should treat login as the start of governance, not the end. After MFA succeeds, segment the environment, constrain privileged protocols, and remove unnecessary internal reach from both human and machine identities. The goal is to prevent a valid credential from becoming unrestricted movement across critical systems.

Q: Why do service accounts create risk even when MFA adoption is high?

A: Service accounts often bypass human authentication workflows and retain broad, persistent access that MFA does not meaningfully govern. If those identities can reach many systems or protocols, an attacker who compromises them can move laterally without needing another login challenge. High MFA adoption does not fix that exposure.

Q: What do security teams get wrong about MFA everywhere?

A: Teams often assume that MFA at the edge protects the whole environment. In practice, it secures the sign-in moment but leaves internal trust, admin protocols, and legacy paths exposed unless they are separately governed. That is where many identity-led incidents escalate.

Q: Who is accountable for internal identity reach when MFA is only enforced at login?

A: IAM, PAM, and infrastructure security teams share accountability for internal identity reach because the risk lives between authentication and authorization. If a team can only measure portal login controls, it is not actually governing the full identity path. Accountability should include protocol access, privilege duration, and lateral movement exposure.

Technical breakdown

Why application-layer MFA stops short of internal reach

Conventional MFA is usually enforced at the application boundary, where a user or workload proves identity before entering a SaaS app, VPN, or portal. That model does not govern downstream network paths, privileged protocols, or legacy assets that sit outside modern identity provider flows. The result is a control gap between authentication and authorization inside the environment. Attackers who already possess valid credentials can often use normal internal pathways because the organisation has authenticated the identity but not constrained its subsequent movement.

Practical implication: treat authentication as only one control point and map where internal reach still exists without policy enforcement.

Service accounts, machine identities, and excessive internal trust

Service accounts and other machine identities are often created for functional convenience, then left with broad reach that exceeds their real job scope. Unlike human users, these identities may operate continuously, communicate machine-to-machine, and authenticate through credentials that are rarely observed in a governance workflow. When that happens, the environment turns operational necessity into implicit trust. The security issue is not merely that machine identities exist, but that they often inherit permissions, protocol access, and persistence that no one revisits after deployment.

Practical implication: scope machine identities to observed protocol use and remove any reach that is not strictly required for operation.

Just-in-time access and network-layer MFA as blast-radius controls

JIT access and network-layer MFA are both attempts to move from static trust to time-bound, context-bound access. JIT removes persistent privilege, while network-layer MFA applies verification closer to the protocol or connection request rather than only at the login screen. Combined with segmentation, these controls make privilege and access more ephemeral and easier to constrain. That is especially important for admin protocols such as SMB, RDP, WinRM, and RPC, where broad internal trust can turn one foothold into rapid escalation.

Practical implication: enforce JIT for privileged work and apply protocol-level verification to the paths attackers actually use for escalation.

Threat narrative

Attacker objective: The attacker aims to turn one authenticated identity into broad internal reach and then use that reach to compromise critical systems.

1. Entry occurs through valid credentials or a compromised identity, which is why MFA alone does not end the attack path once access is obtained.
2. Escalation happens through trusted internal protocols and overprivileged service accounts that can reach far more systems than their role requires.
3. Impact follows when lateral movement reaches critical assets, allowing attackers to expand control, disrupt operations, or expose sensitive systems without needing a new login.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authentication-centric MFA is not the same thing as identity containment. The article correctly exposes a structural weakness in how many programmes define protection at the login boundary and then assume the problem is solved. In NHI terms, service accounts, API-driven workflows, and privileged protocols still need governance after authentication has succeeded. The practitioner conclusion is simple: MFA coverage metrics do not equal containment metrics.

Standing internal trust is the real control debt here. The issue is not only that identities can log in, but that they can keep moving once they are inside the network. That is why a programme can report high MFA adoption and still retain a large attack surface through SMB, RDP, WinRM, RPC, and similar pathways. The implication is that IAM and PAM teams must measure internal reach, not just sign-in assurance.

Microsegmentation becomes an identity control when it constrains what an authenticated identity can actually reach. This is where network enforcement and identity governance intersect: if the identity can authenticate but cannot traverse high-risk paths by default, the attacker’s room to maneuver collapses. For practitioners, the relevant question is not whether MFA exists, but whether the environment still grants broad post-authentication movement.

Machine identity governance cannot be a sidecar to human MFA policy. Service accounts and other non-human identities often sit outside the workflows that manage user access, yet they are central to escalation and lateral movement. The article shows why treating NHI reachability as an operational detail leaves a policy gap that attackers routinely exploit. The practitioner conclusion is that NHI scope, protocol use, and privilege duration must be governed as first-class controls.

Closed-by-default access is the right named concept for this problem. The article’s core insight is that security improves when internal reach is intentionally denied unless a specific business or operational need exists. That model does more than reduce exposure. It changes the assumption that an authenticated identity should be trusted to move freely inside the enterprise. The practitioner conclusion is to govern reach, not just entry.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to Ultimate Guide to NHIs.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing that remediation windows often outlast the attacker’s practical dwell time.
• For a deeper breakdown of real-world failure patterns, see 52 NHI Breaches Analysis, which maps repeated identity abuse to operational control gaps.

What this signals

Closed-by-default internal reach is becoming the practical boundary for identity programmes. High MFA coverage will continue to look good in audit reporting, but it will not meaningfully reduce risk unless internal pathways are constrained and monitored. The programme signal is to shift measurement from authentication completion to reachable surface reduction, especially where service accounts and admin protocols are involved.

Identity teams should expect more convergence between PAM, segmentation, and NHI governance. The more workloads, APIs, and service accounts drive business operations, the more dangerous it becomes to treat identity as a front-door problem only. Mature programmes will increasingly score themselves on how much lateral movement they can prevent, not how many users passed MFA.

For practitioners, the next control question is whether post-authentication access is intentionally designed or merely inherited. That distinction will define whether an environment can resist credential abuse after the first foothold. The right benchmark is not MFA adoption alone, but whether the enterprise can still assume every authenticated identity is trustworthy inside the network.

For practitioners

• Map post-authentication reach for every identity type Inventory which human, service account, and workload identities can traverse privileged ports, legacy apps, and admin protocols after login. Use that map to identify paths where authentication succeeds but reachability remains effectively open.
• Scope service accounts to observed protocol use Reduce machine identity privileges to the exact systems and protocols they actually use in production. Remove inherited access that exists only because the account was created for convenience or legacy compatibility.
• Remove standing privilege from privileged workflows Replace always-on administrative access with time-bound grants for specific tasks, and require explicit reapproval when the task changes. Pair that with strong logging so temporary privilege does not become hidden persistent access.
• Apply protocol-level verification to high-risk paths Add verification and policy enforcement around SMB, RDP, WinRM, RPC, and other internal routes that attackers commonly abuse. Do not rely on application-layer MFA alone to secure those pathways.
• Use segmentation to limit lateral movement by default Design internal zones so a compromised identity cannot pivot freely from one asset to the next. This makes the absence of access an intentional part of the control model, not a remediation after the fact.

Key takeaways

• MFA at the login boundary does not contain attackers who can exploit internal trust, privileged protocols, and overextended machine identities.
• Zero Networks’ figures show why this matters: identity appears in nearly 90% of cyber incidents, yet many enterprises still leave high-risk internal pathways open.
• Security teams should focus on reachability, privilege duration, and protocol-level enforcement if they want MFA to reduce real attack surface.

Key terms

• Network-layer MFA: A verification approach that applies multi-factor checks closer to the network path than the application login screen. It matters because authentication can succeed while internal reach remains open, so the control must govern protocol access as well as sign-in.
• Post-authentication reach: The set of systems, ports, and protocols an identity can use after it has successfully authenticated. In practice, this is where many identity attacks escalate, because the risk sits in what the identity can touch, not only in how it logged in.
• Standing privilege: Persistent access that remains available before a task begins and after it ends. For human users, service accounts, and workloads alike, standing privilege expands the time window in which stolen credentials or abused access can be turned into lateral movement.
• Identity-based microsegmentation: A network control model that uses identity and policy to limit what an authenticated actor can reach. It reduces blast radius by making access explicit at the connection layer, which is especially important when machine identities and admin protocols are involved.

What's in the full article

Zero Networks' full article covers the operational detail this post intentionally leaves for the source:

• Step-by-step explanation of how network-layer MFA applies to SMB, RDP, WinRM, and RPC.
• Detailed four-step playbook linking segmentation, JIT access, and protocol enforcement.
• Implementation framing for legacy apps that cannot join modern identity provider flows.
• The vendor's operational view of identity-based microsegmentation and adaptive policy enforcement.

👉 Zero Networks' full post covers the four-step playbook for protocol-level MFA, segmentation, and JIT access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM, PAM, or NHI programme, it is worth exploring.