MFA and software supply chain security: It's no magic bullet

This article explores the rise in attacks against developer accounts and evaluates mandating MFA across SDLC assets as a mitigation, while emphasizing that MFA is not a complete solution. It highlights industry actions (GitHub, Apple, Google, Valve) and expert opinions, noting that tokens in CI/CD can bypass MFA and that robust authorization, segregation of duties, and mature CI/CD processes are necessary to meaningfully reduce software supply chain risk.