Quarterly incident report:
- VPN enrollment still bypassed for contractors.
- Password reset mailer logs full tokens.