MFA is a baseline, not a finish line. In 2026 the hard part isn't deploying it — it's knowing which accounts, OAuth grants, and AI sign-ups are silently outside its reach. Here's how to measure your real coverage.