What is Identity Attack Surface Management?

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Zero-trust and cloud IAM adoption (Azure AD, Okta) surged with remote work, but Semperis' Sean Deuby argues these strategies still depend on the integrity of on-premises Active Directory.

SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.

Nearly one in seven Entra ID environments saw rogue device registrations in 90 days, Wiz finds; attackers abuse DRS via device-code phishing, and AI-realistic device names erode old fingerprints.

Three OAuth techniques attackers use in Azure, and how Entra ID sign-in logs and JWT claims expose them; includes Wiz telemetry on prevalence and ready-to-use KQL detection queries.