Finding of the Week: MFA missing on remote access and VPN gateways.
This remains one of the most consistently identified issues across infrastructure assessments, and the reason it persists is that the attack path requires almost nothing. Credentials obtained from a previous data breach or a low-effort password spray are sufficient to authenticate directly against an unprotected gateway. No exploitation, no lateral movement required at the entry point - just valid credentials and an open door.
The control is well understood: enforce phishing-resistant MFA on every remote access entry point. The problem we see in practice is inconsistent enforcement. One legacy VPN concentrator left out of scope. One gateway maintained by a third-party team that was never included in the rollout. That inconsistency is what attackers find and use.
If your remote access estate hasn't been reviewed as part of a structured assessment, the assumption that MFA is enforced everywhere is worth testing rather than taking at face value.