0. Realistically, any mature MFA app needs to have a cloud backup option enabled by default. 1. Google did not message their induction of Authenticator cloud b

0. Realistically, any mature MFA app needs to have a cloud backup option enabled by default. 1. Google did not message their induction of Authenticator cloud backups as having a massive impact on their clients' vulnerability surface. 2. It appears a bit from the post-mortem that Retool was considering itself as a SW company, rather than a security-critical infrastructure provider. 3. All of that adds up to - organizations that have much to lose from a compromise need to do their own security thinking and assessment. Corporate-style thinking along the lines of "if it has an enterprise offering, it must be up to scratch" was never enough, and it will never be.