Topic starter
10/07/2026 9:09 pm
TL;DR: Traditional MFA is strongest at login, but attacker activity increasingly escalates through trusted internal paths such as admin protocols, legacy systems, and overprivileged service accounts. Zero Networks’ analysis says identity now drives nearly 90% of incidents, while MFA adoption in large enterprises averages 87%. The gap is internal reach, not authentication alone.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “What “MFA Everywhere” Misses: Closing the Gap Across Service Accounts, Admin Protocols & Legacy Apps”.
By the numbers:
- Identity now plays a material role in nearly 90% of cyber incidents, according to Zero Networks.
- MFA adoption rates now average 87% in large enterprises, according to Zero Networks.
- Just 2.6% of workload identity permissions are actually used, according to Zero Networks.
Key questions
Q: What breaks when MFA is used only at sign-in and not for privileged actions?
A: The main failure is stale trust.
Q: Why do service accounts create risk even when MFA adoption is high?
A: Service accounts often bypass human authentication workflows and retain broad, persistent access that MFA does not meaningfully govern.
Q: How should security teams implement JIT for privileged access?
A: Security teams should implement JIT at the permission layer, not only at the session layer.
Practitioner guidance
- Map internal trust paths Inventory which admin protocols, service accounts, and legacy systems remain reachable after login, then classify those pathways by blast radius rather than by application ownership.
- Scope service accounts to observed behavior Restrict machine identities to the minimum systems and protocols required for their actual operational role, and review any unused permissions as governance drift.
- Replace standing privilege with JIT access Move privileged access from persistent grants to time-bound, purpose-bound elevation so that administrative reach disappears when the task is complete.
Bottom line: MFA reduces one class of risk, but it does not stop lateral movement once attackers are inside the network.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:32 pm
Internal reach, not login success, is the real identity control boundary: MFA at the edge can still leave the network wide open if protocols, service accounts, and legacy systems remain implicitly trusted. That means the security question has shifted from whether a session was verified to whether anything meaningful can still be reached after verification. For identity programmes, the practical conclusion is that authentication and reachability must be governed together.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between application-layer MFA and network-layer MFA?
A: Application-layer MFA verifies entry to a service, while network-layer MFA can verify access closer to the protocol or path being used inside the environment. The first protects sign-in, but the second helps govern internal reach where lateral movement actually happens.
👉 Read our full editorial: MFA everywhere still leaves service accounts and protocols exposed