Attackers are bypassing MFA by targeting VPNs, RDP, and legacy Windows systems that still rely on passwords alone. Here's how to close those gaps before they do.
You've set up multi-factor authentication on your email and your cloud apps. Feels safe, right? Here's the uncomfortable truth: attackers are still getting in. Not by breaking MFA, but by walking right past it.
### The Problem Isn't MFA Itself
MFA works. When it's actually turned on. The gap is everywhere it isn't. Think about the tools your team uses every day: VPNs, Remote Desktop Protocol (RDP), and older Windows machines. Many of these still rely on a username and password alone. No second check. No safety net.
So when a password gets stolen (and they do, all the time), there's nothing standing between the attacker and your internal network. They log in like a regular employee. Nobody notices for weeks.
### Why Cloud-Only Protection Falls Short
A lot of companies focus their MFA rollout on cloud applications. That makes sense, it's where the modern work happens. But here's the thing: attackers know that too. So they aim for the doors you forgot to lock.
- VPN credentials are often shared or reused across services
- RDP ports are exposed to the internet more often than anyone wants to admit
- Legacy Windows systems may not even support modern MFA methods
- Service accounts and admin tools frequently skip MFA entirely
One stolen password from a phishing email can be enough to pivot from a single laptop into your entire infrastructure.
### What Attackers Actually Do Once They're In
It's rarely dramatic. No alarms go off. They move quietly.
First, they establish persistence, creating new accounts, scheduling tasks, or installing remote access tools. Then they look around. They map your network, find the valuable data, and figure out how to stay hidden. By the time someone notices unusual login times or strange traffic, the damage is often already done.
> The scariest part isn't the breach itself. It's how long it takes to realize it happened.
### Closing the Gaps Without Breaking Your Workflow
You don't need to rip everything out and start over. But you do need to treat every entry point the same way.
Start by auditing what's actually protected. Make a list: which systems require MFA, and which ones don't. You'll probably find a few surprises. Then extend MFA to cover VPNs, RDP gateways, and any Windows endpoint that touches sensitive data.
Where legacy systems can't handle modern MFA, look at alternatives: conditional access rules, network segmentation, or identity-aware proxies. The goal is simple. No password alone should ever be enough to get inside.
And don't forget the human side. Train your team to recognize phishing attempts, because that's still how most credentials get stolen in the first place.
### The Bottom Line
MFA isn't broken. Your coverage is. Attackers aren't geniuses, they're opportunists. They go where the locks are weakest, and right now, that's often the systems you assumed were safe.
Close those gaps, and you make their job a whole lot harder. Ignore them, and you're just hoping you're not next. Hope isn't a security strategy.