What should organisations do first to prepare for more complex cyber attacks?

Why MFA belongs in the first wave of defence

For organisations preparing for more complex attacks, MFA is the fastest way to reduce the value of stolen passwords and limit automated account takeover. It does not stop every compromise path, but it raises the cost of opportunistic intrusion and buys time for the other controls that harden exposure over the longer term. When the goal is to shrink the immediate blast radius, this is the first control to enforce broadly.

That is especially true where attackers are testing password reuse, phishing, and token abuse at scale. A weak login process lets a routine compromise become a foothold; MFA forces the attacker to overcome an additional trust check before they can move into more damaging activity.

• Ultimate Guide to NHIs is useful here because it frames how credential strength, rotation, and visibility change exposure across modern identity estates.
• CISA cyber threat advisories help teams track the attack patterns that MFA is meant to slow, especially credential theft and mass compromise activity.
• CISA Secure by Design reinforces the principle that protective defaults should be built in early rather than layered on after exposure has already spread.

What has to happen after MFA is in place

MFA should be treated as the opening move, not the finish line. Once it is enforced consistently, the next priorities are the controls that reduce the chance of successful initial access, credential replay, and post-compromise escalation: user awareness, fast patching, email filtering, and regular review of privileged and high-risk accounts. Those layers matter because sophisticated attacks usually combine multiple weak points rather than relying on only one.

The practical test is whether the organisation can still absorb phishing, session theft, or exploitation of a known vulnerability without immediate lateral movement. If the answer is no, then MFA has been deployed as a gate, but not yet as part of a defensible access model.

• The 52 NHI breaches Report shows how compromised credentials and exposed secrets turn a single initial access event into broader compromise.
• CISA Known Exploited Vulnerabilities Catalog is the right companion for patch prioritisation because it focuses teams on vulnerabilities that are already being actively used in the wild.
• FIRST EPSS can help rank patching work by likely exploitation, which is more practical than treating all defects as equally urgent.

Risk and Threat Considerations

Complex attacks rarely begin with a dramatic exploit. They often start with credential abuse, a phishing success, a stolen session, or an unpatched entry point, then expand through trust relationships and weak recovery discipline. If MFA is inconsistent, the attacker only needs one exposed path to turn a routine login problem into a broader incident.

Failure mechanism: Single-factor logins, weak fallback flows, or uneven rollout create bypass paths that attackers can combine with password spraying, phishing, token theft, or replay to get initial access.

Impact: The organisation loses time, visibility, and containment advantage at the exact point where early friction matters most, which increases the chance of privilege escalation, lateral movement, and persistence.

Practitioner Guidance

What to prioritise: Enforce MFA first on the accounts and channels that would give an attacker the most leverage, then extend coverage to the long tail of users, admins, and remote access paths. If a control exception exists, treat it as a documented risk decision rather than an informal convenience.

What to verify: Confirm that MFA is actually enforced, not merely offered, and check that recovery and reset flows do not undermine the control with weak fallback verification. The common failure is deploying MFA on paper while leaving the easiest path into the environment effectively single-factor.

Practitioner takeaway: The first objective is to make initial access materially harder before you spend effort on broader detection and response, because a strong perimeter around accounts is what keeps the later controls from being overwhelmed immediately.

Related resources from NHI Mgmt Group

• How should organisations prepare for cyber attacks that increasingly mimic human behavior and target AI systems?
• What should organisations do first when AI-driven attacks speed up exploitation?
• How should organisations prepare identity evidence for a cyber insurance renewal?
• Why do AI-driven attacks change the way organisations plan cyber resilience?