Just because you have MFA on that one account, like you said, there's also like the management interface facing the internet and being able to get into that because that's a different authentication path than the main SSL VPN path.

I mean, a few years ago, we had an incident where MSP that we managed, they had, oh, what was it? They had an account with Duo, but in bypass mode.

So with MFA enabled on that account, that account was allowed to bypass MFA.

I mean,

that's how NIST 853, I mean, every time we go through that with a client, we talk about them ensuring that their vendors and third parties are abiding by their terms and conditions, not what the vendor wants to do, but by the organization's policies.

If the organization requires everybody to use multi-factor, the vendor has to use multi-factor.