# mfa-blind-zone

Source: https://startwithidentity.com/glossary/mfa-blind-zone/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

The MFA blind zone is the set of breaches in which the abused path had no interactive login where MFA could have applied: a service account, API key, token or OAuth app, or a flaw that skips the login step entirely. Start with Identity defined the term in the [Identity Breach Report 2026](https://startwithidentity.com/reports/identity-breach-report-2026/); in the underlying [Identity Breach Database](https://startwithidentity.com/breaches/incidents/) these are the incidents with MFA status "not applicable".

The blind zone grew from 7 of 33 incidents (21.2%) in 2021-2022 to 11 of 39 (28.2%) in 2023-2024 and 22 of 48 (45.8%) in 2025-2026, and across the whole period it holds 40 of 120 incidents, more than either bypassed or missing MFA. The 2025-2026 growth came from machine identities (npm worms, the tj-actions GitHub Action, OAuth tokens stolen from SaaS integrations, cloud service principals) and from appliance flaws that hand out an authenticated session without a login. The point for defenders: an MFA rollout, however good, cannot reach almost half of the newest breaches. Those need short-lived machine credentials, token binding such as [DPoP](https://startwithidentity.com/glossary/dpop/), fast patching of identity edge devices, and revocation signals that reach every app.

See also: [fan-out breach](https://startwithidentity.com/glossary/fan-out-breach/), [talk-past attack](https://startwithidentity.com/glossary/talk-past-attack/), [non-human identity](https://startwithidentity.com/glossary/nhi/), [token theft](https://startwithidentity.com/glossary/token-theft/), [static API key abuse](https://startwithidentity.com/techniques/static-api-key-abuse/), [token replay at unbound endpoints](https://startwithidentity.com/techniques/token-replay-unbound-endpoint/), [OAuth Transaction Tokens](https://startwithidentity.com/standards/oauth-transaction-tokens/)