How the Consoles Got Skipped

MFA programs were scoped by headcount and by who was asking. Insurers and auditors asked first about remote access and email, so the whole workforce got an authenticator app. A hypervisor console has a handful of users, sits on an internal network, and belongs to the infrastructure team. It gets filed under “already behind the firewall” and left with a password (often a shared one).

From One Login to the Backup Console

“Behind the firewall” stopped being a protection when attackers quit breaking in. Palo Alto Networks’ 2026 Global Incident Response Report found that 65% of initial access in real-world incidents is identity-based. The intruder arrives with a working username and password, so the perimeter treats that person as an employee because, by every test it runs, an employee is who logged in. CrowdStrike’s 2026 Global Threat Report clocks the average time from initial access to lateral movement at 29 minutes. The fastest case it observed took 27 seconds.

From there, the route barely varies. Fenix24’s 2026 State of Recoverability Report, which draws on more than 500 ransomware recoveries, found Active Directory or its equivalent implicated in effectively every one. It’s typically the first major system to fall, because nearly everything else takes its word for who an administrator is. Backups included. Among the more than 800 organizations analyzed in the report, 94% ran backup infrastructure joined to the same directory the attacker compromises first.

Little stands between that directory and the consoles. Only 15% of the organizations in the report lacked sufficient controls at network ingress, but 95% had no meaningful multifactor protection on their infrastructure consoles. A stolen domain admin credential signs in to the backup console the way its owner would. Retention gets shortened and restore points get deleted. The hypervisor is used to encrypt virtual machines at the datastore, underneath every endpoint agent the company paid for. When the ransom note appears, the recovery was lost days earlier, at a login page that asked for one password.

The Case for Moving the Money

Set that against a budget. Most organizations run several layers of defense at the network edge. Adding one more lowers the chance of an intrusion only slightly. It does little about the majority that begin with an attacker logging in on valid credentials. The same money spent on the management plane changes what a stolen credential can do once it is inside, starting with the backups. It is also the smaller project. The administrators who need these consoles would fit around one conference table.

Two objections usually follow. One is that the consoles sit on an isolated management network. Some do. More often the isolation includes a jump server joined to the production domain, which turns the wall into a hallway. The other is that privileged access management covers these accounts. A PAM tool that takes its logins from Active Directory, with no factor of its own, falls when the directory does.

Lock the Consoles, Then Test Them

The remedies are known and none requires a new product category. Put phishing-resistant MFA on every management interface, enforced at the console and not only at a portal in front of it. Move backup systems off the production domain, give them credentials that exist nowhere in the directory, and keep a copy that no directory account can alter. Rehearse standing up a clean directory, since every other restore waits on one. All of this slows administrators down and puts break-glass accounts in a safe, so nobody volunteers for it. The consoles belong to infrastructure and the MFA program belongs to security, which leaves the work between two budgets.

A CISO can test the argument in an afternoon without spending anything. Pick one administrator account and assume its password has been stolen. Have someone trace how far that password alone gets toward the delete function in the backup console. Count how many times anything asks for a second proof of identity.

In most environments that end up in a ransomware recovery, the count is zero.

Many security budgets assume an attack is won or lost at the front door. The recovery data says it’s decided at the consoles, after the attacker is inside and before anyone knows it. Next year’s budget can reflect that without growing. Before approving another control at the edge, list what the business would use to restore itself, beginning with the directory, the hypervisors, and the backup platform. Fund the protection of those systems first. An organization that does this will still be attacked, sometimes successfully. It will have something left to recover with.