MFA Blind Zone
The MFA blind zone is the set of breaches in which the abused path had no interactive login where MFA could have applied: a service account, API key, token or OAuth app, or a flaw that skips the login step entirely. Start with Identity defined the term in the Identity Breach Report 2026; in the underlying Identity Breach Database these are the incidents with MFA status "not applicable".
The blind zone grew from 7 of 33 incidents (21.2%) in 2021-2022 to 11 of 39 (28.2%) in 2023-2024 and 20 of 43 (46.5%) in 2025-2026, and across the whole period it holds 38 of 115 incidents, more than either bypassed or missing MFA. The 2025-2026 growth came from machine identities (npm worms, the tj-actions GitHub Action, OAuth tokens stolen from SaaS integrations, cloud service principals) and from appliance flaws that hand out an authenticated session without a login. The point for defenders: an MFA rollout, however good, cannot reach almost half of the newest breaches. Those need short-lived machine credentials, token binding such as DPoP, fast patching of identity edge devices, and revocation signals that reach every app.
See also: fan-out breach, talk-past attack, non-human identity, token theft, static API key abuse, token replay at unbound endpoints, OAuth Transaction Tokens
Related on Start with Identity
- GlossaryClient Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine acc
- GlossaryPhishing-Resistant MFA
Multi-factor methods that cannot be relayed or replayed by a phishing site, principally FIDO2 security keys and passkeys. Recommended by NIST and CISA over OTP
- GlossaryAgent Registry
An agent registry is an inventory of the AI agents an organization runs or allows, recording for each one its identity, accountable human owner, purpose, permis
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- ReportPhishing-Resistant MFA Support Matrix 2026
54% of 95 business SaaS apps support passkeys or security keys, but only 13% let admins require them, and 60% of apps with a documented SSO plan charge more for
- BlogThe SMS off-ramp has a date now: what Entra, GOV.UK and America.gov mean for your MFA plan
Microsoft stops delivering SMS and voice codes in Entra ID on February 1, 2027. The UK has opened passkeys to more than 23 million GOV.UK One Login users, and t