[bakatubas]

Or mandate 2FA and password managers.

[goodpoint]

Even that is often not enough: sessions are long lived and very often stealing a cookie is all the attacker needs.