When an RDP session is initiated with potentially stolen credentials, BullWall provides an MFA challenge that can be a traditional MFA or a token grid without needing a second device. If the challenge fails, BullWall blocks the intrusion.