MFA verifies who logged in. It has no idea what they do next.

The compliance dashboard was green across every identity control. And the attacker was already inside, moving laterally through Active Directory with a valid session token, escalating privileges on a trajectory toward the domain controller. This is the scenario playing out inside enterprises that invested heavily in authentication and assumed the job was done.