nothing is 100% secure. no matter how many audits you do. However, not having 2fa on email server story.. what happen? Was email server directly on internet? (

nothing is 100% secure. no matter how many audits you do. However, not having 2fa on email server story.. what happen? Was email server directly on internet? (who has mail gateways right??) or was owa configured without 2fa. Those 2 things should come out in any pentest or external network audit. Seems a bit silly oversight. That being said. i repeat, nothing is 100% secure. 99.8% of people working at this company dont know anything about security is very inaccurate. They do have a big team of hackers (40+) besides all of their security officers, auditors and whatnot. So i think ,as they really push for the cyber side of things also, they will have a little more aware people. And really, i think these companies should practice what they preach. If they miss such a missconfiguration on their own servers, why trust them auditing mine????