Some customers also report that mobile app push notifications occasionally lag when new access requests come through. Customers with limited IT resources report the configuration complexity as a barrier. Some users also report fatigue from frequent push notifications, and the three-digit code verification step adds friction that not everyone appreciates. Get it wrong, and you’re dealing with help desk floods, shadow IT workarounds, or authentication gaps that compliance auditors will catch before attackers do. Entra ID, formerly known as Azure Active Directory, serves as the backbone of Microsoft’s identity and access management platform. https://seonote.info/how-to-achieve-maximum-success-with/ Conditional Access policies that enforce MFA compliance are also likely affected, potentially preventing device logins, VPN authentication, and access to cloud-hosted business applications that use Entra ID as their identity provider.

Some users have also reported difficulties with MFA registration and reset processes. Monthly updates on CSA Chapters, including local events, chapter activities, leadership highlights, and opportunities to connect with your regional cloud security community. Expecting first-responders or healthcare workers to be carrying smartphones for authenticating to different systems only creates barriers to adoption.

If enrollment is difficult or token replacement creates help desk tickets, adoption suffers and the security benefit of MFA is undermined. Pre-built connectors vary in quality; verify that your identity provider, cloud apps, VPNs, and on-premises resources are covered before committing. Beyond our top 11, these MFA solutions are worth considering depending on your specific requirements. Licensing and maintenance costs run higher than cloud-native options in this space. We think it remains a strong option for organizations in regulated industries that need physical authenticators and on-premises deployment options. If you’re a smaller team without dedicated IAM resources, the learning curve on some components may slow you down.

Unexpected Windows bloat is due to bug, not by design

SMS one-time codes technically add a second factor, but they are the weakest common method because of SIM-swapping and interception risk. The cost of implementing MFA across a small practice is typically under $500 — a fraction of even the smallest HIPAA penalty. Verify that your BAA with each cloud vendor covers their MFA capabilities and your obligation to enable them. Contact your EHR vendor to enable MFA if it is not already active.

The Token Theft Kill Chain in SaaS Environments

The attacker receives the username, password, and the live session cookie the moment authentication completes. The user enters their credentials and approves their MFA request, completely unaware that every exchange is being captured on the attacker’s server. Evilginx is built on top of the widely used nginx web server and is designed to proxy web traffic through attacker-controlled fake sites in real time. With that cookie in hand, an attacker can replay the session from any device, anywhere in the world, without needing the victim’s password or MFA code ever again.

However, other experts say this number is exaggerated, as there are many ways to get past MFA if you’re a criminal, including social engineering and interception. She spent hours on the phone reporting the theft to an unhelpful and incredulous fraud department who asked “Are you sure a relative didn’t do this? These highlight how threat actors can exploit weak MFA implementations and other MFA security vulnerabilities. Examples of MFA security vulnerabilities include the 2022 Uber prompt bombing attack and the 2023 social engineering attacks that targeted Las Vegas resorts. See the following for additional information on MFA requirements, compliance standards, security vulnerabilities, and best practices for strengthening authentication security, including how the RSA External Authentication Methods (EAM) with Microsoft help organizations meet stringent regulatory mandates.

• The problem with single-factor authentication is that an attacker only needs to successfully attack the user in one way in order to impersonate them.
• Both options provide stronger protection than one-time codes or mobile push notifications.
• These tokens serve as proof that a user has already passed authentication checks, including passwords and MFA prompts.
• – Users report initial setup complexity requires dedicated identity expertise
• Examples of MFA security vulnerabilities include the 2022 Uber prompt bombing attack and the 2023 social engineering attacks that targeted Las Vegas resorts.

How to Check If You’re Ready

• It helps to ensure strong authentication can be consistently enforced across users and applications without weakening centralized security controls.
• According to Datadog’s 2024 State of Cloud Security report, initial access for a breach is most often achieved through credential stuffing attacks.
• The user enters their credentials and approves their MFA request, completely unaware that every exchange is being captured on the attacker’s server.
• After a 2FA app has been properly installed onto a user’s device, be it a personal device or company-managed device, they then can enroll their individual logins in the service.
• These attacks can come in many forms—most commonly in the form of a convincing email, text message, or social media message.

Some vendors have created separate installation packages for network login, Web access credentials, and VPN connection credentials. When MFA applications are configured to send push notifications to end users, an attacker can send a flood of login attempts in the hope that a user will click on accept at least once. SMS passcodes were routed to phone numbers controlled by the attackers and the criminals transferred the money out.

Microsoft Entra ID

Regular TOTP apps (like Google Authenticator) and push notifications can be intercepted through techniques like MFA fatigue attacks, where attackers spam push notifications until a tired user approves one. In a SIM cloning scam, attackers create a functional duplicate of the victim’s smartphone’s SIM card, enabling them to intercept passcodes sent to the user’s phone number. Evaluate vendor reliability, including responsive support and trial options to test performance. The market is crowded, vendors overpromise, and the wrong pick means either frustrated users bypassing controls or gaps that attackers walk straight through.

• Advances in artificial intelligence (AI) image generation also raise concerns for cybersecurity experts, as hackers might use these tools to trick facial recognition software.
• JumpCloud’s open directory platform enables organizations to securely connect employees to resources with robust multi-factor authentication and single sign-on.
• When attackers compromise a SaaS vendor, they gain access to OAuth tokens that connect the vendor’s systems to customer environments.
• OAuth tokens stolen from a vendor breach extended attacker access through trusted connections into over 700 customer environments.
• Microsoft MFA helps protect you by adding an additional layer of security, making it harder for attackers to log in as if they were you.
• In one real-world example, attackers sent employees SMS phishing messages pointing to fake login pages for the organization’s single-sign-on service.

Organizations should report anomalous cyber activity and or cyber incidents 24/7 to or Say-CISA. If a password is compromised, MFA creates a second barrier that makes it much harder for the threat actor to access your systems and data. These attacks can come in many forms—most commonly in the form of a convincing email, text message, or social media message. An increasingly common approach to defeating MFA is to bombard the user with many requests to accept a log-in, until the user eventually succumbs to the volume of requests and by mistake accepts one. IT regulatory standards for access to federal government systems require the use of multi-factor authentication to access sensitive IT resources, for example when logging on to network devices to perform administrative tasks and when accessing any computer using a privileged login.

Access tokens typically expire within hours, but refresh tokens can remain valid for days, weeks, or even 90 days in some Microsoft environments. MFA prevents initial credential compromise but cannot prevent token theft that occurs after successful authentication. Organizations experiencing vendor breach notifications should assume OAuth tokens may be compromised and proactively revoke integrations with affected vendors. Traditional MFA methods vulnerable to AiTM attacks include SMS codes, authenticator app OTPs, and push notifications that users can approve without verification. Organizations should enforce device-bound tokens where possible, particularly for privileged accounts and access to sensitive resources. Preventing token theft requires a multi-layered approach that acknowledges MFA alone is insufficient protection.

This is the most common second factor in healthcare settings. Something you have — a physical device like a smartphone (for push notifications or authenticator apps), a hardware security key (YubiKey, Titan Key), or a smart card. The proposed 2026 HIPAA Security Rule updates would eliminate the distinction between “required” and “addressable” implementation specifications. You can find a list of CUNY-specific Microsoft Multi-factor Authentication FAQs in CUNY IT Help.

Finally, the attackers logged into victims’ online bank accounts and requested for the money on the accounts to be withdrawn to accounts owned by the criminals. Then the attackers purchased access to a fake telecom provider and set up a redirect for the victim’s phone number to a handset controlled by them. MFA adds an extra layer of protection to user accounts, helping to thwart unauthorized access by putting more obstacles between attackers and their targets. Organizations including Google, Apple, https://nutritioninpill.com/6-facts-about-businesses-everyone-thinks-are-true-2/ IBM and Microsoft offer passwordless authentication options. Likewise, attackers can spoof their IP addresses to make it look as if they are connected to the corporate VPN.

Infosys approaches modernization through standardized enterprise frameworks built for large-scale execution consistency. Architectural decisions typically evolve from IBM’s own tooling and infrastructure stack, which may constrain how far applications can be reimagined for truly cloud-native or multi-cloud environments. IBM’s modernization capabilities are often shaped by its existing platform ecosystem. Accenture typically approaches modernization through enterprise-wide transformation programs with extensive upfront alignment requirements. Varseno Solutions is a focused legacy software modernization company specializing in refactoring-led application re-engineering.

• NeuGAIN Modernization embeds AI intelligence across every phase of transformation, helping teams make faster decisions, automate execution, and improve modernization outcomes.
• Our blog on understanding legacy code cites a Krugle study that found developers spend only 11 to 30 percent of their time fixing technical debt, and roughly half of that time is spent just understanding the source.
• SaaS solutions provide regular updates, compliance support, and lower operational overhead.
• Cross-functional modernization experts combine domain knowledge, architecture expertise, and AI-powered delivery to accelerate transformation outcomes.
• The formulas account for your specific application profile regardless of the underlying technology.

Our role focused on aligning the system with real academic https://lievell.com/chinese-govt-hackers-exploiting-new-atlassian-vulnerability-microsoft-says.html?noamp=mobile workflows while preparing it for further scale. After the changes, the system responded noticeably faster — response times improved by more than 60%, and the platform handled a five times higher load without degradation. Another example of legacy modernization is the internal trading platform that supports day-to-day investment decisions, portfolio management, and regulatory reporting. Developers also moved faster, cutting feature delivery time by 20% as technical friction decreased.

At this stage, technology no longer supports growth — it slows it down. But first, let’s clarify what legacy modernization means in https://angliannews.com/b2b-website-developmen-advantages-and-features.html practice today and what benefits it may bring. In the section below, we will explore legacy modernization examples across different industries and technical contexts.

Automated exploration and discovery

• Whilst our experience has primarily focused on prompt engineering for extracting business variables, rules, and explanations, we believe that integrating frameworks like BREX with AI could enhance the representation and description of business rules.
• Teams that begin with code translation often hit walls because they don’t understand the source system well enough.
• That work used to take months and failed often.
• The top IT service companies for legacy modernization clearly articulate how deeply they restructure application architecture.

Modernization provides opportunities to implement zero-trust architecture, automated security monitoring, and compliance controls that legacy systems cannot support. Legacy systems pose significant security risks through outdated encryption, unsupported software with known vulnerabilities, and limited integration with modern security tools. This reduces risk compared to complete rewrites and delivers value faster through gradual improvements. Each microservice handles a specific business function and communicates through well-defined APIs, reducing dependencies that make legacy systems rigid. Breaking monolithic legacy applications into microservices allows independent scaling, faster updates, and technology stack flexibility.

Lessons from building Claude Code: Prompt caching is everything

With our Zoho expertise, your business is equipped to scale, adapting quickly to market changes and customer needs. Our comprehensive support and training programs ensure you get the most out of your Zoho products. A legacy platform that cannot support new products or regulatory requirements will continue to create friction, making incremental improvement ineffective. Re-architecting redesigns system structure to support scalability, resilience, and modern capabilities.

Measuring ROI Through Cost, Speed, and Operational Impact

Bill also serves as executive sponsor of Deloitte’s CIO Program, offering CIOs and other tech executives insights and experiences to navigate the complex and evolving challenges they face in business and technology. For more than 25 years, Bill has delivered complex transformation programs for clients in a variety of industries, including Financial Services, Life Sciences & Health Care, Consumer, Telecommunications, Energy, and the Public Sector. Bill also drives the incubation of new assets, solutions, and businesses across Deloitte’s industries and offerings, while shaping the strategy for Deloitte’s evolving technology-related services, talent model, and market positioning. In this role, he identifies, researches, and champions the emerging technologies affecting clients’ businesses.

AI replaces the high-cost senior consultant hours typically required for legacy comprehension. A modernization program that previously needed 18–24 months can often deliver in 9–12 months with AI acceleration. Mainframe programs run longer; mid-sized enterprise systems often complete in 9 months end-to-end. The documentation, capability maps, and test suites AI produced during the program become permanent assets for the team inheriting the new system. Human engineers review every AI output before committing.

How to Choose the Right Legacy Modernization Company

Your COBOL engineers bring the understanding of regulatory requirements, business priorities, operational constraints, and risk tolerance that AI cannot. What’s proven particularly effective is going deep into understanding the specific business domain and building battle-tested practices for each client’s specific case. Tasks that took months, code documentation, dependency mapping, and business rule extraction are now complete in days or weeks. While this ensures repeatable delivery, modernization paths are typically shaped by predefined templates rather than system-specific refactoring strategies. IBM typically doesn’t publish standard pricing for mainframe modernization tools because projects vary in complexity and scale. Learn how businesses can deepen their understanding of customers and anticipate their needs with predictive analytics.

Legacy systems have high change failure rates because every change is risky when the system isn’t well-understood or testable. Track incident frequency, mean time to recovery, and change failure rate. Track deployment frequency, lead time for changes (commit to production), and mean time to recovery. Organizations with significant legacy debt typically see infrastructure cost reductions of 30–50% after structured modernization (McKinsey). Measure reduction in maintenance labor (hours/week before vs. after), infrastructure cost at 6 and 12 months post-migration, and vendor license savings from retiring end-of-life platforms. Developers ship new features without touching everything at once.

The engineers who built the original COBOL or Fortran systems are retired or unavailable. This blog explains what AI-driven legacy modernization means, the 5 R’s framework, key AI techniques used in 2026, and how to plan a modernization program built around AI from day one. For the past two decades, legacy modernization has been a high-cost and high-risk discipline. It also explores the 5 R’s framework, key AI techniques, benefits, challenges, and how enterprises can modernize faster, cheaper, and with lower risk using AI. For manufacturers, distributors, and enterprise-level businesses in the US, off-the-shelf … These industries typically have mission-critical applications running on outdated stacks where unplanned downtime has severe operational and compliance consequences.

Whilst our experience has primarily focused on prompt engineering for extracting business variables, rules, and explanations, we believe that integrating frameworks like BREX with AI could enhance the representation and description of business rules. Model-based frameworks, such as BREX for COBOL systems, provide engineers with a systematic approach to extract, visualize, and describe the business variables and rules implemented in a legacy codebase. Therefore, collaboration between reverse engineers and Subject Matter Experts (SMEs) is crucial. However, it is crucial to understand existing behavior to make informed decisions about what to retain, discard, and introduce in your new system. In the subsequent sections, we delve deeper into specific modernization challenges that, if solved using GenAI, could significantly impact the cost, value, and time for modernization – factors that often discourage us from making the decision to modernize now. This means we are not treating code just as text, but through employing language specific parsers, we can extract its intrinsic structure, and map the relationships between entities in the code.

Integration risk is closely related — poorly documented integrations create cascading failures when any component changes. Full visibility into scope, cost, and risk before committing to a full program. With those answers, you can scope the work, build the business case with real numbers, and go into vendor conversations knowing what to ask. What would “good enough” look like in 18–24 months?