@nopatience @argv_minus_one @GossiTheDog Agreed. There are very robust defensive controls that exist before you get to smart cards.
Over half of the orgs in the dataset are under 250 users. They don't have the time, money, or the expertise to deal with smart cards.