Insufficient Authentication Controls

MFA, when some things have MFA but some don’t.

• There was MFA but we were able to bypass it so there’s still a flaw
• Some MFA, but some don’t have MFA

When you can’t get access to check for MFA, you can ask the client if they have it set up.