Listen on Spotify

Our MFA is optional?

Cold open

The security review is going normally until someone asks a very small question with very large consequences: "Are we enforcing MFA on everyone?" The answer arrives with an alarming amount of punctuation. "Mostly."

That one word does a lot of damage. It means some users are protected, some are not, and the organization has chosen to outsource part of its identity security posture to personal preference.

HR-Z0 case note: optional controls become mandatory incidents.

The horror

Optional MFA creates a fragile environment:

Symptoms

The symptoms are always recognizable:

some users are secured and others are not
exceptions accumulate quietly
admins assume the policy is stronger than it is
edge-case accounts become blind spots
leadership overestimates the real baseline

This is how companies end up feeling compliant while still being surprisingly easy to compromise through ordinary human behavior.

Cost

The cost is not abstract.

Time: senior staff lose days to access cleanup, lockouts, and incident retros that should have been prevented by baseline controls.
Money: emergency response, audit remediation, and avoidable downtime are the most expensive way to run security.
Trust: once access looks random, leadership assumes every control is optional, including the important ones.

The root cause

The lockout or over-permission event is the symptom. Exception culture is the disease.

1

Enforcement was never completed

Many organizations start MFA rollout as a project and finish it as an aspiration. Legacy accounts, service accounts, shared logins, and awkward exceptions remain outside the rule.

2

Identity hygiene is fragmented

MFA is often discussed separately from admin roles, guest access, password posture, and break-glass planning. In reality, they are one operating surface.

3

Ownership is weak

If nobody owns the actual enforcement state, the business ends up with a policy statement instead of a control.

4

Exceptions became policy through operational inertia

If nobody owns the actual enforcement state, the business ends up with a policy statement instead of a control.

The fix

The fix is not a security memo. The fix is enforced baseline behavior that survives turnover.

1

NorthStar maps the real identity baseline

NorthStar identifies which accounts are covered, which are exempt, which are risky, and where the organization is confusing policy with practice.

2

Oort enforces practical identity control

Oort improves the baseline through:

MFA enforcement
exception cleanup
role and account review
clearer ownership of identity controls

The outcome is not theoretical security maturity. It is fewer preventable identity gaps.

3

Oort turns baseline controls into continuous operations

We automate access reviews, exception expiry, backup/restore verification, and sharing enforcement so security does not depend on heroic memory.

Security controls stop being controls when they become suggestions.

HR-Z0

Comms Officer

Comms Officer HR-Z0 (a.k.a. “H.R. Zero”) is Galaxie’s deadpan broadcast voice for the Office Horror Stories series — part dispatcher, part incident historian, part morale damage control.
Built from equal parts helpdesk transcripts, post-mortems, and calendar trauma, HR-Z0 doesn’t “tell stories.” It files reports from the front lines of messy operations — where ownership evaporates, folders time-travel, and a “quick change” becomes a six-month saga.