Semperis Expert: SolarWinds Attack Highlights Need to Secure AD

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

AD Security 101's monitoring installment explains what Active Directory is, why attackers target it, and why continuous monitoring is a foundational step for AD health and identity security.

Semperis adds Azure AD threat indicators to Directory Services Protector, complementing on-prem AD monitoring; explains how cloud credential compromise escalates into on-prem privileges and details indicators like unused administrative units.

Reprinted from Network Security: two decades on, Active Directory remains foundational yet largely unchanged; its default-open posture and unconstrained delegation—plus the SolarWinds example—argue for rethinking how AD is secured.

Semperis CEO Mickey Bresman on why AD is a keystone: 47% of organizations rely on it as their primary identity store, and cloud identities still sync back to on-prem AD—so compromise cascades. Tested recovery plans and AD monitoring are urged.