Security is like an onion and in this case every layer was rotten. * Social engineering successfully got someone * MFA approach did not protect from a simple

Security is like an onion and in this case every layer was rotten. * Social engineering successfully got someone * MFA approach did not protect from a simple fake webpage tunneling hack * VPN was based on a password rather than a certificate * Network scan was not detected and stopped * High level credentials were stored in a public file and not detected * Abnormal credential usage was not detected and stopped I probably missed a few but point there were many ways to stop this hack and all of them were broken. This wasn't some highly funded government operation that bypassed layers through clever approaches and expensive zero-day exploits.