Topic starter
10/07/2026 9:19 pm
TL;DR: MFA often remains uneven across legacy systems, remote access, and privileged workflows, leaving password-based paths open even where organisations believe they are protected, according to Secret Double Octopus. The real issue is not MFA presence but enforcement coverage, phishing resistance, and proof that controls apply everywhere attackers can reach.
Editorial analysis by NHI Mgmt Group, based on content published by Secret Double Octopus: “Top MFA Blind Spots: Why “We Have MFA” Isn’t Enough Anymore”.
Key questions
Q: What breaks when MFA is used only at sign-in and not for privileged actions?
A: The main failure is stale trust.
Q: Why do phish kits create so much risk for organisations even when MFA is in place?
A: Phish kits increase risk because they can steal both passwords and valid MFA or OAuth tokens before those tokens expire.
Q: What signs show that MFA enforcement is weaker than policy says?
A: Look for shared admin accounts, legacy apps outside SSO, permanent exceptions, passwords still used at endpoints and different login flows across systems.
Practitioner guidance
- Map authentication enforcement by access path Inventory SaaS, legacy applications, VPN, RDP, SSH, endpoint login, shared admin accounts and break-glass workflows, then record where MFA is enforced, bypassed or absent.
- Replace phishable factors on exposed paths Prioritise phishing-resistant authentication for remote access, privileged workflows and any login path reachable from the internet or a user-controlled device.
- Control exceptions as expiring access debt Require business justification, owner approval and expiry dates for every MFA exception, with regular review of whether the exception still reflects operational need.
Bottom line: MFA creates a false sense of coverage when legacy systems, remote access and privileged workflows remain outside consistent enforcement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:41 pm
Coverage is not control when authentication enforcement is fragmented. A programme can claim MFA deployment and still leave the most dangerous paths exposed if legacy systems, remote access and privileged workflows are exempted. The control only exists where it is enforced consistently, which is why governance has to focus on path coverage, not policy statements. Practitioners should treat incomplete enforcement as a structural identity risk, not an implementation detail.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams handle access when MFA infrastructure is unavailable?
A: They should predefine the failure state before it happens, then test it. If a control outage causes the system to default to open access, that is a design defect, not resilience. High-assurance environments need offline validation or tightly governed local fallback paths, with clear ownership and review.
👉 Read our full editorial: MFA blind spots expose why coverage is not the same as control