You need to know the in and outs of your system to defend implementations. DIBCAC comes in with speficic bias,. They had some devices too old to MFA. Worked with DIBCAC and created a VLAN so those machines are behind the box with MFA.