Multi-factor authentication (MFA) verifies who logged in, but it has no idea what they do next. This is the scenario playing out inside enterprises that invested heavily in authentication and assumed the job was done.
The credential was real. The multi-factor challenge was answered correctly. The system performed exactly as designed. It authenticated the user at the front door and never looked again.
Authentication proves identity at a single point in time. Then it goes blind. Everything that follows, the lateral movement, the privilege escalation, the quiet exfiltration through Active Directory, falls outside what MFA was ever designed to see.
Alex Philips, CIO at NOV, identified the gap through operational testing. “We found a gap in our ability to revoke legitimate identity session tokens at the resource level. Resetting a password isn’t enough anymore. You have to revoke session tokens instantly to stop lateral movement,” he said.
The average e-crime breakout time dropped to 29 minutes in 2025, with the fastest recorded breakout clocked at 27 seconds, according to the report.
Adam Meyers, Senior Vice President of Counter Adversary Operations at the company, said, “Adversaries have figured out that one of the fastest ways to gain access to an environment is to steal legitimate credentials or to use social engineering.”
Vishing attacks exploded by 442% between the first and second halves of 2024, according to the report, while deepfake fraud attempts rose more than 1,300% in 2024, according to the findings.
The threat is not that AI makes one attacker more dangerous. The threat is that AI gives every attacker expert-level social engineering at near-zero marginal cost.
By 2026, 30% of enterprises would no longer consider face-based identity verification and biometric authentication solutions reliable in isolation due to AI-generated deepfakes, the researchers predicted in a 2024 report.
Related: Galaxy S27 Ultra Snapdragon Chip: Another Hint Just Dropped!
Identifying the Gap
Kayne McGladrey, IEEE Senior Member, framed the organizational failure in business terms. “Anything that seems to have a cybersecurity flavor is generally put into the cybersecurity risk category, which is a complete fiction. They should be focused on business risks, because if it doesn’t affect the business, like a financial loss, then nobody’s going to pay attention to it, and they will not budget it appropriately, nor will they adequately put in controls to prevent it.”
Mike Riemer, Ivanti’s Field CISO, has watched this disconnect play out across two decades of shifting paradigms. “I don’t know you until I validate you. Until I know what it is and I know who is on the other side of the keyboard, I’m not going to communicate with it until they give me the ability to understand who it is,” he said.
Closing the Gap
Alex Philips said, “It gives us a forced security policy enforcement gateway. Users and attackers on a flat network can use stolen identity session tokens, but with zero-trust gateways it forces conditional access and revalidation of trust.”
NOV shortened token lifetimes, built conditional access requiring multiple conditions, and enforced separation of duties so no single person or service account can reset a password, bypass multi-factor access, or override conditional access.
They deployed AI against SIEM logs to identify incidents in near real-time and brought in a startup specifically to build rapid token revocation for their most critical resources.
Philips also flagged a trust chain vulnerability that most teams overlook. “Since with AI advances you can’t trust voice or video or even writing styles, you must have either preshared secrets or be able to validate a question only you and them would know.”
To close the gap, NOV prioritized the following steps:
- Pull the token lifetime report for every privileged account, service account, and API key.
- Shorten interactive session tokens to hours, not days.
- Put service account credentials on a defined rotation schedule.
- Run a session revocation drill under fire.
- Map cross-domain telemetry end to end.
- Extend conditional access enforcement past the front door.
- Replace SMS and push-based MFA with phishing-resistant FIDO2 and passkey-based authentication.
- Audit separation of duties on identity workflows.
- Establish an out-of-band incident verification protocol with preshared secrets.
- Create a dedicated budget line for identity-layer governance.
Philips‘ team went from discovering they couldn’t kill a compromised session to standing up rapid token revocation under real attack conditions. They shortened token lifetimes, eliminated single-person credential resets, deployed AI-driven log analysis, and built a dedicated revocation capability for their most critical resources.
The gap NOV closed exists inside nearly every enterprise that treats authentication as the finish line instead of the starting gun. Philips put it plainly: “Resetting a password isn’t enough anymore. You have to revoke session tokens instantly to stop lateral movement.” His team built the answer. The gap is a critical vulnerability that every other CISO must find and address before an attacker moving at 27 seconds finds it for them, which is why staying informed about technology news is essential for success.
