Pam Rotella

The new $18,000 coffee machine in our office requires employees to sign in with their work account. To get coffee. Security insisted on MFA because the machine stores employee preferences. So here's my morning now. Walk to kitchen. Select cappuccino. Enter corporate email. Enter password. Approve notification on phone. Select milk. Machine says: SESSION EXPIRED Start over. The CFO asked why coffee consumption dropped 70%. I explained that employees have started bringing instant coffee because nobody wants to complete a security challenge before caffeine. He asked if we could disable authentication. Security said no. "An attacker could access someone's beverage preferences." I asked what the worst-case scenario was. They said someone might order a drink using another employee's identity. I said that sounded like a coffee problem, not a cybersecurity incident. They escalated me to the CISO. Yesterday the CEO couldn't get his espresso because his phone was updating. He personally approved an authentication exception. Only for his account. So now the most powerful man in the company can get coffee without MFA. Everyone else needs to verify their identity to obtain 200ml of milk. Security says the system is working as intended. I have opened an investigation into whether the CEO's espresso constitutes privileged access abuse.