MFA gaps

Multi-factor authentication (MFA) requires a second form of verification beyond a password to authenticate. The user proves they know the password and that they have access to a second factor, typically a code from an authenticator app, a hardware key, or a push notification.

An MFA gap is any account, application, or access path where this second factor is not required. The account can be accessed with credentials alone.

MFA gaps usually come from deployment that stopped halfway. MFA gets enforced in one place while other places are never updated. Legacy configurations predate the current policy and nobody rechecks them. Service accounts get excluded because MFA interrupts automated processes. The gap is rarely a deliberate decision that MFA wasn't needed.

MFA is typically rolled out in phases. Email first, because that's where most logins happen and where compromise has the most visible impact. Then VPN, then the main directory, then SaaS tools as they're added.

But rollouts rarely touch everything at once. Old configurations stay. New users get MFA required; people who joined before the policy change may still be running on the old setting. Admin accounts are sometimes excluded during rollout because getting MFA working on every admin account in a live environment takes coordination.

Service accounts are a specific category. MFA typically can't be applied to non-interactive accounts the same way as human accounts. They need a deliberately chosen alternative form of protection, and without one they're often left with none at all.

Over time, each of these gaps is forgotten or assumed to be someone else's responsibility to fix.

Credentials are compromised regularly. Phishing, password reuse from breaches at other services, credential stuffing at scale. Verizon's DBIR 2026 puts the use of stolen credentials as a factor in 36% of breaches. MFA breaks the path from compromised credential to successful login.

Microsoft's research puts the figure at more than 99.2% of account-compromise attacks blocked by MFA. That figure applies to accounts with MFA enforced. An account without it doesn't benefit from that protection.

The highest-priority gap is admin accounts without MFA. An admin account reached via compromised credentials gives an attacker the highest privilege in the relevant system. A password alone is the only barrier between those credentials and that access level.

The second category is legacy accounts. Accounts created before MFA policy was in place and never updated. They're often less visible because they don't fail authentication, they just authenticate with fewer factors than the current standard.