When a single ransomware attack can cancel surgeries, divert ambulances, and cancel classes within hours, "we're too small to be a target" stops being a credible security strategy for any organization including yours.

Employees did everything security training told them to do typed the password, approved the MFA prompt, and attackers walked into their inbox anyway, because this attack never needed to beat MFA at all; it just stole the session that came after it.