When the Vault Is the Target, the Door Doesn't Matter

The door is a distraction

Security teams spend most of their effort on the front door: credentials, MFA, SSO. Attackers who want the contents have learned to go around it. They look for the walls: integrations, service accounts, backups, and the people who already hold the keys.

Protecting the contents

If the vault is the target, the design question is not "how do I make the door stronger?" It is "how do I make the contents useless to anyone who was not supposed to have them?"

That means tying access to a verified person at the moment of use, not just at the moment of login. A stolen session that cannot act without proving a human is present is a stolen session that cannot do damage.