U.S. Indictment of Sandworm Highlights the Importance of Protecting Active Directory

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Service accounts are business-critical but hard to find and govern, making them frequent attack entry points. The post explains the risks and how automated, layered controls close the security gap.

Twelve AD security best practices: minimize privileged users, secure admin accounts, modern password policies, disable SMBv1, restrict NTLM, plan recovery, use SID filtering, and monitor activity.

Argues AD recovery is an essential, often-overlooked part of ITDR: with 50% of organizations attacked and pen testers exploiting 82% of AD exposures, recovery capability matters as much as prevention.

Semperis CEO Mickey Bresman on why AD is a keystone: 47% of organizations rely on it as their primary identity store, and cloud identities still sync back to on-prem AD—so compromise cascades. Tested recovery plans and AD monitoring are urged.

The FireEye breach and SolarWinds supply-chain attack (SUNBURST, 18,000 customers) revived NotPetya parallels: an exploited NETLOGON flaw could hand attackers domain-admin rights; Maersk's week-long manual AD rebuild showed the stakes.