The Stryker cyberattack in March 2026 was not complicated. That is the uncomfortable part.

An attacker obtained administrator credentials to a cloud device management platform. They used those credentials to issue remote wipe commands. Over 200,000 devices across 79 countries went dark before most employees had their morning coffee. No zero-day exploit. No novel malware. Just a username, a password and an account with too much power and too little protection.

This happens constantly at smaller scale and gets far less attention. The Stryker incident was extraordinary in scope but entirely ordinary in method. Which means the lessons from it are not specialised knowledge. They are basics that should already be in place everywhere.

Here is what protecting privileged accounts actually requires in 2026.

PHISHING-RESISTANT MFA IS NOT OPTIONAL FOR ADMINS

Standard multi-factor authentication, the kind that sends you a code by SMS or asks you to approve a push notification, is no longer adequate for administrator accounts. The 2025 Verizon Data Breach Investigations Report documented a surge in MFA bypass methods. Adversary-in-the-middle phishing, which captures session tokens after a legitimate MFA challenge is completed, can defeat SMS codes, authenticator app one-time passwords and push notifications. The MFA check passes. The attacker gets the session cookie anyway.

For administrator accounts specifically, FIDO2 hardware security keys are the current standard. They are bound to the physical device and cannot be captured or replayed remotely. Microsoft, NIST and CISA all recommend phishing-resistant MFA for privileged access. If your admin accounts are still protected by push notifications, they are protected by something attackers already know how to bypass.

THE PRINCIPLE OF LEAST PRIVILEGE APPLIES TO PLATFORMS TOO

A Microsoft Intune account with global administrator rights and the ability to wipe every enrolled device is a significant risk. Not every admin needs that level of access. Role-based access controls exist specifically to limit the blast radius of a compromised account. A compromised account that can only wipe devices in one region is a serious incident. A compromised account that can wipe every device in 79 countries simultaneously is a catastrophe.

Review which accounts have what level of access to your device management console. Separate device wipe permissions from routine administration permissions. Require additional approval steps for destructive actions. These are controls that MDM platforms natively support and that many organisations have simply not configured.

PRIVILEGED ACCESS WORKSTATIONS MATTER MORE THAN MOST TEAMS ADMIT

Administrator tasks should be performed from dedicated, hardened devices that are not used for general browsing, email or any activity that might expose them to infostealer malware. Check Point Research confirmed that the likely initial access method in the Stryker attack was infostealer malware that harvested credentials from a compromised device. If your administrators are checking their email and browsing the web on the same machine they use to manage your entire device fleet, you are one malicious email attachment away from a very bad morning.

MONITOR FOR UNUSUAL ADMIN ACTIVITY IN REAL TIME

A single administrator account issuing remote wipe commands to tens of thousands of devices is anomalous behaviour. It should trigger an alert within seconds. If your security information and event management system is not configured to flag bulk destructive actions through administrative platforms as a high-priority alert, configure it now. Behavioural baselines and anomaly detection are not exotic capabilities. They are standard features of modern security platforms that require someone to turn them on and set appropriate thresholds.

CONDITIONAL ACCESS NEEDS TO COVER ADMIN SCENARIOS EXPLICITLY

Conditional access policies that restrict where and how administrators can authenticate are a baseline protection, not an advanced one. Administrators should only be able to perform privileged actions from known, compliant devices. Access from unrecognised devices or unusual geographic locations should require additional verification or be blocked outright. Microsoft Entra ID provides this capability natively. Using it is a configuration task, not a procurement one.

PRACTICE YOUR INCIDENT RESPONSE BEFORE YOU NEED IT

The Stryker incident went public within hours because the scale was impossible to conceal. Smaller organisations that experience similar attacks through their MDM platforms often take days to understand what happened because they have no prior experience investigating device management logs under pressure. Run a tabletop exercise that starts from the scenario “our MDM admin account has been compromised and bulk wipe commands are being issued.” Find the gaps in your detection, response and communication process now rather than at 3:30 in the morning.

None of these controls require exceptional resources or specialised expertise. They require configuration, governance and the recognition that an admin account is not just a password. It is the operating authority over your entire device estate.