Multi-factor authentication has become a standard defense for cloud applications, but attackers are still finding their way in through systems that lack the same protection. According to a report covered by BleepingComputer, stolen credentials are being used to access VPNs, RDP, and Windows environments that remain password-only. These gaps let attackers bypass the security that organizations assume is already in place.
The issue, as explained by Specops, is that MFA coverage is often incomplete. While cloud apps may be locked down, the same cannot be said for remote access tools and legacy Windows infrastructure. An attacker with valid credentials can simply walk through the door if no second factor is required at that entry point.
Closing these gaps means treating every authentication surface as equally critical. Organizations should audit where MFA is enforced and where it is missing, then extend protection to all remote access and internal systems. The lesson is not that MFA fails, but that partial MFA leaves the front door open.