Why Cloud MFA Alone Cannot Protect Your Entire Windows Environment

Organizations may require multi-factor authentication (MFA) for Microsoft 365 and other SaaS applications while leaving VPN, RDP, Windows logon, and older Active Directory services protected by passwords alone. Attackers regularly exploit these authentication gaps to turn stolen credentials into network access.

How an MFA gap helped attackers access a network

On August 4, 2026, an Akira ransomware affiliate launched a password-spraying attack against a SonicWall SSL VPN. After approximately seven minutes, one attempt succeeded. Although the credentials were valid, the VPN account was not protected by multi-factor authentication.

Approximately two hours later, the attacker used RDP to access the domain controller and began enumerating Active Directory.

The ransomware deployment ultimately failed, but the attackers had already stolen credentials and file-sharing data.

The incident highlights a common problem: organizations may have MFA enabled for cloud applications while leaving other access paths protected by passwords only. This fragmented authentication environment creates gaps that attackers can exploit.

Stolen credentials remain a valuable tool for attackers

Once an attacker obtains a valid account, they can interact with an environment through the same authentication mechanisms used by legitimate employees and administrators. AI adds a new dimension by helping attackers perform familiar techniques faster and at greater scale.

The underlying identity tactics remain largely unchanged. Attackers still compromise identities, reuse credentials, escalate privileges, and abuse legitimate access. The concern is that AI may make these activities cheaper and easier to run at scale.

According to a Mandiant ransomware investigation, legitimate credentials were compromised during initial access in 21% of the 2025 incidents studied. An entry point could typically be established through RDP or a VPN.

RDP also frequently appears later in the attack chain. In approximately 85% of the ransomware incidents studied, attackers used RDP for lateral movement with compromised or newly created accounts.

How to identify stolen credentials in Active Directory

Strong authentication helps limit what an attacker can do with a stolen password, but organizations also benefit from identifying exposed or compromised credentials before they are used. Password reuse, weak password choices, and credentials found in previous breaches increase the likelihood that an attacker will find a password that still works somewhere in the environment.

Periodic password auditing is therefore a useful part of Active Directory security. Specops Password Auditor is a free, read-only password auditing tool that scans Active Directory for password-related vulnerabilities. It displays the results in an interactive report with user and password policy information.

Auditing gives IT teams an opportunity to identify password weaknesses and address them wherever possible. It also helps ensure that a compromised password is not enough to gain access to critical systems.

Why cloud MFA does not protect every Windows access path

Microsoft 365, identity providers, and SaaS applications are internet-connected and frequently targeted, making additional authentication factors essential. However, cloud MFA does not automatically extend to every system that relies on the same user identity.

MFA may be required when users access SaaS applications through a corporate identity provider, while the same account may be accepted elsewhere with only a password.

This creates a fragmented authentication environment in which some access routes are more secure than others. Attackers can focus on the least-protected path.

VPNs are a potential gap. As the August Akira ransomware attack demonstrated, when MFA is not enforced, an attacker who obtains or brute-forces a valid username and password may be able to use those credentials to gain remote network access.

IT and security teams should ask more than whether MFA is enabled. They should also ask where a password is still sufficient. The review should include:

• Windows logon
• RDP access
• VPN authentication
• Older Active Directory-based services

Extend MFA to Windows logon, RDP, and VPN access

Closing authentication gaps means applying strong authentication wherever credentials are still trusted, rather than treating MFA as protection that exists only in front of cloud applications.

Specops Secure Access extends MFA to Windows logon, RDP, and VPN authentication. This adds protection to access paths that attackers routinely target with stolen Active Directory credentials.

It also supports single sign-on (SSO) for SaaS applications through OIDC and SAML, allowing organizations to apply a more consistent authentication approach across on-premises and cloud services.

Authentication can also provide valuable security telemetry. Specops Secure Access integrates with SIEM, SOC, and analytics platforms to bring authentication events and suspicious activity into broader monitoring processes.

Protecting users is only part of the picture. Organizations should also consider whether they trust the device making the request.

Reduce the risk of password theft and ransomware access

Even in 2026, stolen passwords remain a powerful tool for attackers when they are accepted into a VPN, RDP session, or Windows system without additional checks. MFA coverage is therefore just as important as adopting MFA in the first place.

Securing cloud applications is essential, but it does not eliminate the risks posed by authentication paths elsewhere in the environment that still rely solely on passwords.

No single control can stop every intrusion, and MFA is no exception. However, organizations can reduce the risk of credential-based attacks by asking a simple question: Where can I use my password alone?

Adding another layer of protection to these access points with Specops Secure Access helps ensure that one stolen credential does not become the easiest route into the rest of the network.

Want to close the gap in your identity security strategy? Book a demo with Specops today.

Sponsored and written by Specops Software.