Multi-factor authentication (MFA) has become one of the most important cybersecurity protections for businesses. Many organizations now require employees to approve sign-ins through Microsoft 365, cloud applications, and other essential services, significantly reducing the risk associated with stolen passwords.

However, having MFA enabled doesn’t necessarily mean every system in your business is protected. Attackers continue to exploit inconsistencies in authentication, particularly across VPN connections, Windows systems, Remote Desktop Protocol (RDP), and older applications that may still rely exclusively on passwords.

The challenge isn’t necessarily that businesses lack MFA. It’s that MFA may not be protecting every way someone can access their systems.

A Recent Ransomware Attack Exposed a Familiar Weakness

In August 2026, an affiliate of the Akira ransomware group targeted an organization’s SonicWall SSL VPN using password spraying, a technique that tests commonly used passwords against multiple accounts.

According to reporting from Huntress, the attackers successfully authenticated approximately seven minutes after beginning their attempts. The compromised VPN account had valid credentials but no multi-factor authentication protection.

Within roughly two hours, the attackers used RDP to access a domain controller and began examining the organization’s Active Directory environment. Although the ransomware deployment ultimately failed, credentials and file-share data had already been stolen.

The incident demonstrates how a single unprotected access point can undermine an organization’s broader cybersecurity investments. The attackers didn’t need to bypass MFA because they found a connection that didn’t require it.

Why Microsoft 365 MFA Doesn’t Protect Everything

For many businesses, Microsoft 365 was the first platform where MFA became mandatory. Employees now approve authentication requests through Microsoft Authenticator or other methods, adding an important layer of protection against compromised credentials.

However, Microsoft 365 authentication policies don’t automatically extend to every system in a company’s technology environment. An employee may need MFA to access Outlook or SharePoint while still being able to connect to a VPN, sign in to a Windows workstation, or access an internal server using only a username and password.

These differences often develop over time as organizations introduce new systems, work with different vendors, or maintain older applications that weren’t originally designed with modern authentication requirements.

For attackers who obtain valid credentials through phishing, password reuse, or previous data breaches, those inconsistencies create opportunities. Rather than attempting to compromise a well-protected cloud account, they can search for another service where the same credentials are accepted without additional verification.

Stolen Passwords Remain a Serious Business Risk

Despite improvements in authentication technology, compromised credentials remain a common starting point for cyberattacks.

Research from Google’s Mandiant indicates that legitimate credentials accounted for initial access in approximately 21% of investigated ransomware incidents in 2025 where the entry point could be established. RDP also appeared frequently during subsequent attacker activity, allowing compromised accounts to be used for movement between systems.

Once attackers obtain valid credentials, their activity can resemble normal employee behavior. They may connect through approved remote-access services, explore shared folders, or attempt to reach systems containing sensitive business information.

This is why strong passwords and MFA should work together with appropriate access restrictions and authentication monitoring. Protecting credentials is important, but limiting what those credentials can access is equally essential.

Where Businesses Should Look for Authentication Gaps

Many small and midsize businesses operate technology environments that have evolved over several years. A VPN may have been configured long before Microsoft 365 was introduced, while older applications or administrative tools may still rely on traditional Active Directory authentication.

These systems can continue functioning normally without drawing attention to the fact that their authentication requirements differ from those used elsewhere in the organization.

A practical security review should answer several important questions:

• VPN access: Does every remote connection require MFA, including those used by administrators and external vendors?

• Remote Desktop: Can employees or administrators establish RDP sessions using only a password?

• Windows authentication: Are sensitive workstations and privileged access paths protected by appropriate additional controls?

• Legacy applications: Are older systems still accepting passwords without additional verification?

• Administrative accounts: Are privileged accounts subject to stronger authentication requirements?

• Monitoring: Are suspicious login attempts and unusual remote-access activities being reviewed?

Not every system supports MFA in the same way, and some older applications may require alternative safeguards. The important step is identifying where passwords remain the only barrier and addressing those gaps according to their potential business impact.

MFA Is Only as Effective as Its Coverage

Multi-factor authentication remains one of the most valuable security controls businesses can implement. It makes stolen passwords significantly less useful and adds an important barrier between attackers and sensitive systems.

However, protecting Microsoft 365 while leaving VPN connections, remote desktop services, or administrative accounts dependent on passwords alone can create unnecessary exposure.

A strong cybersecurity strategy requires consistent authentication policies across cloud applications, internal systems, and remote-access services. Businesses should understand where exceptions exist, why they are necessary, and what additional protections are in place.

The lesson from the recent ransomware incident is straightforward: attackers don’t need to defeat your strongest security controls if another entry point remains less protected.

The question worth asking your IT provider isn’t simply whether your business has MFA enabled. It’s whether an attacker could still access part of your network using only a stolen password.