3 Steps to Protect AD from Wiperware

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.

Why SolarWinds should push organizations to secure AD: attackers gained initial access through on-premises AD, and AD admin access yields total on-prem and cloud visibility—continuous monitoring and layered defense are essential.

The 2026 threat hierarchy: ransomware syndicates (Akira, Qilin, LockBit, DragonForce) and state-aligned APTs (Lazarus, Volt Typhoon, APT29, OilRig), with TTPs and defensive strategies.

Semperis argues that testing backups under ideal conditions creates only an illusion of resilience; real cyber resilience is about staying recoverable when the plan fails and the assumptions behind it collapse.