These are all interesting and worth looking at, but I found some metrics weird too. For example:

> 40 percent of organizations have at least one IAM user that has AWS Console access and does not have multi-factor authentication

Yeah, I hope your last resort, non-root account is locked in a safe place and has no multi-factor on it. Statistics are cool, but some context behind the findings is also useful.

Similar story with the active root accounts. If they exist only on paper in a safe, that's fine.