#identity-access-lifecycle

Field Note · Jul 5, 2026 · Colten Anderson

Russian intelligence turned off an NGO's MFA with a text file

AA22-074A didn't beat multi-factor auth with an exploit. It made the MFA server unreachable and let the fail-open default do the rest. Here's the twenty-minute audit that tells you whether yours would do the same.