No. I did not say we should do nothing. What I said was people keep focusing on the one thing that the attackers used to get in, but that one thing is besides t

No. I did not say we should do nothing. What I said was people keep focusing on the one thing that the attackers used to get in, but that one thing is besides the point. I explicitly said that MFA raises the stakes. The point I was trying to make was that whatever the attack was, the thing that gets reported on, is so very rarely an attack that engineers side with the defender. It's almost always something like "oh why didn't they do X" where X could be thousands of things. I know you say you're "not trying to be a dick" and all, but this is what I wrote in my original comment: > the long tail of organizations just don't have the right staff, focus, or resources to do it. If you reread my original comment you'll see what I'm trying to get software developers to understand. Securing these systems is nigh on impossible. Orgs lack incentives to do it to the fullest degree. If it weren't, 0days for iOS or Windows would cost billions. I'm not excusing these large organizations—though actually working with the people involved gives me some perspective as to why they don't always have MFA on their VPNs—I'm trying to get the broader point across that we shouldn't trust such critical infrastructure to vulnerable computers. That there should be regulations and audits with fines. And honestly, the way you worded your final paragraph is kinda confusing. You've seen a couple dozen orgs with account takeovers and your conclusion is that they're all playing with fire? Maybe what I said in my original comment on the article has some merit. Regardless, I've seen enough to know that "the problem" isn't a random VPN lacking MFA.