More Patches, More MFA — So Why Do Breaches Keep Happening?

If you manage IT or security at a mid-sized enterprise, you've probably felt it this year: the volume of "must patch now" alerts has become unmanageable, and the security controls you were told would finally close the gap — multi-factor authentication, passkeys, single sign-on — are getting undermined anyway. You're not imagining it, and you're not behind. The math has genuinely changed.

 

Microsoft's September 2026 Patch Tuesday shipped 974 CVEs in a single release — after 622 in July and 421 in August — putting one month's output within striking distance of Microsoft's entire 2025 total of roughly 1,130. Two of those September vulnerabilities were already being exploited in the wild before the patches even landed, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to set a remediation deadline for federal agencies. Adobe added another 172 disclosures the same week, including a zero-day in Magento and Adobe Commerce that attackers were actively using days before the fix shipped. Security researchers covering the release have pointed to AI-accelerated vulnerability discovery as a driver: the tools finding bugs are getting faster than the teams patching them. (Coverage: The Register)

 

At the same time, a separate and unrelated campaign making the rounds this month shows the identity side of the house isn't safe by default either. Coordinated threat actor groups have been impersonating IT help desks by phone and text, telling employees their passkey or MFA setup urgently needs to be "updated," and walking them straight to convincing fake Microsoft sign-in pages. From there, attackers use adversary-in-the-middle techniques or device-code login flows to take over Microsoft 365 and Entra ID accounts — then quietly register their own MFA method to keep access even after the victim resets their password. Once in, they sit inside SharePoint and OneDrive, pulling data out over an extended period rather than smashing and grabbing. (Coverage: The Hacker News)

 

Neither of these stories is really about Microsoft, or about any one vendor. They're both proof of the same underlying problem: **security tooling and security postures are two different things, and the gap between them is where breaches live.**

 

 

Nobody's IT team is patching 974 vulnerabilities the week they drop, and no vendor expects them to. The teams that stay protected aren't the ones patching fastest across the board — they're the ones who know, within hours, which handful of those hundreds of CVEs actually touch their environment, which are being exploited right now, and which can safely wait a patch cycle. That triage requires continuously correlated vulnerability intelligence against your actual asset inventory, not a monthly spreadsheet exercise built from vendor bulletins.

 

This is precisely the gap InfoSight's Mitigator® platform is built to close: continuous vulnerability and risk intelligence that tells your team what matters in your environment specifically, ranked by real exploitability and business impact — reviewed and validated by InfoSight's security analysts, not just auto-scored and left for someone to interpret at 5 p.m. on a Friday. AI does the scanning and correlation at a scale most internal teams can't sustain on their own; a human analyst confirms what actually deserves your attention this week. That's the "Powered by AI. Fueled by Experts." model in practice, and it's the difference between a patch backlog that quietly becomes your biggest exposure and one that's actively managed down.

 

 

The help-desk impersonation campaign is a useful reminder that "phishing-resistant" authentication describes the cryptography, not the human being enrolling in it. Attackers didn't break passkeys mathematically — they social-engineered the enrollment and recovery process around them, the part every MFA rollout still routes through a person who can be pressured, rushed, or convinced by a caller who sounds exactly like internal IT. Multi-factor authentication and passkeys are necessary. On their own, they were never going to be sufficient.

 

What actually catches an account takeover like this one is behavior, not credentials: a new MFA method registering itself outside normal patterns, a login flowing through an unusual device-code path, or a sudden spike in SharePoint and OneDrive downloads from an account that's never touched that volume of data before. Individually, each of those events can look unremarkable. Correlated and watched continuously, they're an unmistakable signal — but only if someone is actually watching, 24/7, with the context to tell normal from anomalous.

 

That continuous watch is what InfoSight's Purple Team SOCaaS is built to provide: always-on monitoring, detection, and response across your identity and network environment, backed by analysts who validate what the automation flags before it ever reaches your team as a "you have a problem" alert instead of noise to triage. For organizations that also need ongoing identity and access governance — who has privileged access, whether it's still appropriate, how enrollment and recovery are actually being handled — InfoSight's Virtual Security & GRC Leadership Services (VSGRC) provide that oversight without requiring you to hire a full internal security leadership team.

 

Ready to see where your current setup has gaps? Talk to an InfoSight security advisor →

 

You don't need to read every CVE bulletin or threat report to know whether you're exposed. A few honest answers usually tell the story:

 

If a critical, actively-exploited vulnerability landed in your environment tomorrow, could your team tell you — within hours, not days — which of your systems it actually touches? If an employee's MFA method changed today, would anyone notice it wasn't the employee who changed it? And if the answer to either is "probably not quickly enough," the gap isn't a tooling gap. It's a monitoring and response gap, and it's the single most common reason well-patched, well-authenticated organizations still end up breached.

 

 

Record patch volumes and phishing-resistant authentication are both signs the industry is moving in the right direction. Neither one, by itself, is protection. Protection is continuous: vulnerability intelligence that's validated against your real environment, identity monitoring that catches the anomaly before it becomes an incident, and a team — augmented by AI, not replaced by it — actually watching for both. That's the model InfoSight builds for mid-to-large enterprises in manufacturing, financial services, and healthcare, where the cost of "we'll get to it next patch cycle" is measured in regulatory exposure and downtime, not just inconvenience.

 

Get an outside look at your vulnerability management and identity monitoring posture. Schedule a meeting with InfoSight →