Improve Hybrid AD Security with Automated Response and Streamlined Administration

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Semperis adds Azure AD threat indicators to Directory Services Protector, complementing on-prem AD monitoring; explains how cloud credential compromise escalates into on-prem privileges and details indicators like unused administrative units.

Semperis CEO Mickey Bresman on why AD is a keystone: 47% of organizations rely on it as their primary identity store, and cloud identities still sync back to on-prem AD—so compromise cascades. Tested recovery plans and AD monitoring are urged.

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

Cyber resilience is a whole-organization effort. Which roles a resilient org needs in place before the next identity crisis hits—and why HIP 2026 is worth a team trip.

Service accounts are business-critical but hard to find and govern, making them frequent attack entry points. The post explains the risks and how automated, layered controls close the security gap.