Why is Active Directory still a top attack target?

Adversaries heavily target Active Directory to exploit complex identity stacks and use compromised credentials to move laterally. This tactic is highly successful; <a target="_blank" href="https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m02/cisco-pioneering-identity-intelligence-defends-against-most-persistent-cyber-threat.html">more than 26% of all Cisco Talos Incident Response engagements</a> involve attackers using compromised credentials on valid accounts. Severe visibility gaps, unremoved legacy permissions, and bypassed authentication controls have created a culture of blind trust, making AD infrastructure the ultimate target for malicious actors.

How do attackers move laterally through Active Directory?

Visibility gaps and a lack of security controls allow attackers to compromise forgotten, over-privileged, and administrator accounts in AD. Once compromised, these accounts provide a gateway into other accounts in AD, enabling them to move laterally through the network.

What is the difference between Active Directory MFA and Active Directory Defense?

Active Directory MFA extends MFA protection to Active Directory authentications, including legacy protocols such as Kerberos and NTLM. It helps to secure legacy and command line interface (CLI) applications that authenticate with Active Directory by inserting MFA challenges directly into the authentication flow at the domain controller. This helps block unauthorized access by requiring additional verification beyond passwords for a wider range of Active Directory authentications, including legacy and CLI logins.Active Directory Defense is a broader, comprehensive strategy that includes Active Directory MFA as a component and adds enhanced visibility, intelligence, and compliance capabilities for on-premises AD environments. It provides:<ul><li>Deep visibility into on-prem AD identities, including privileged, guest, and non-human/service accounts</li><li>Identity security posture management and threat detection with continuous hygiene checks and attack path mapping</li><li>Unified reporting and audit-ready logs to meet compliance and cyber insurance requirements</li><li>Protection for legacy authentication protocols with simplified MFA enforcement without complex proxies or a rip-and-replace approach</li><li>Integration into a cohesive identity and access management (IAM) platform that supports hybrid environments</li></ul>

What does modern Active Directory hardening look like?

Active Directory hardening is the process of securing and strengthening an Active Directory (AD) environment. It involves implementing best practices, configurations, and controls to safeguard AD infrastructure—including domain controllers, user accounts, authentication protocols, and access permissions.Key aspects of Active Directory hardening include:<ul><li>Securing connections to AD servers: Use strong passwords for AD join and directory accounts, enable encrypted communication protocols such as STARTTLS or LDAPS, and use SSL certificates from trusted certificate authorities for authentication to domain controllers or LDAP servers.</li><li>Applying security policies: Deploy Group Policy Objects (GPOs) with restrictive and well-designed security settings at the Organizational Unit (OU) level to control access and behavior of AD objects and servers. Block inheritance of conflicting policies to maintain consistent security posture.</li><li>Auditing and monitoring: Enable comprehensive auditing of AD events such as account logons, account management, directory service access, policy changes, and system events to detect unusual or unauthorized activities.</li><li>Reducing attack surface: Remove or disable dormant, privileged, or non-human/service accounts that accumulate unnoticed, and enforce multi-factor authentication (MFA) especially for legacy protocols like Kerberos and NTLM that are common attack vectors.</li><li>Compliance and reporting: Maintain audit-ready logs and reports to meet regulatory and insurance requirements for privileged access and identity security.</li></ul>

Why is Active Directory hard to replace?

Active Directory has served as the backbone of identity for decades and is deeply embedded in most enterprise architectures, making a rip-and-replace strategy with more modern, cloud-based IdP solutions impractical. Organizations should instead harden AD by extending security controls – such as MFA – to their AD architectures while maintaining cloud-based identity.

Product & Engineering

Why Active Directory is the identity problem CISOs cannot walk away from

Q: What is Kerberoasting?

Kerberoasting is a post-exploitation attack technique that targets Service Accounts in AD. It exploits the way the Kerberos protocol handles authentication to steal password hashes, which are then cracked offline to gain unauthorized access and escalate privileges. This stealthy attack gives the attacker the "keys to the kingdom" that they can then use to escalate their own privileges and move unfettered across the network. Since the exploit relies on the fundamental way Kerberos was designed and subsequent hacking happens offline on the attacker’s own hardware, no logs on the corporate network are created and observable activity looks like legitimate behavior.

Q: What is Pass-the-Hash?

A Pass-the-Hash (PtH) attack is a method where an attacker steals a hashed user credential and uses it to create a new authenticated session on the same network, bypassing the need for the user's plaintext password. This access allows the attacker to jump from machine to machine, harvesting additional hashes until they find a Domain Admin or high-privileged account.

Katherine Yang

September 01, 2026 8 minute read

Today's security leaders often find themselves stuck between a rock and a hard place: Active Directory (AD) continues to be a foundational legacy infrastructure (in fact, 90% of the Fortune 1000 still uses AD) but inherent technical debt, visibility gaps, and an inability to extend MFA to these legacy authentication paths have created a serious security gap that enterprising threat actors are actively targeting.

Cisco recently surveyed 28 CISOs from around the world to better understand their concerns about the AD security dilemma. The consensus is that it would be impractical to walk away from AD despite the inherent security risks—forcing them to implement new security strategies and controls that harden this legacy identity infrastructure.

For a comprehensive dive into all our conversations, visit our CISO Perspectives homebase. Here's how security leaders are securing their legacy identity infrastructure for modern architectures.

Organizations can't walk away from AD

The 28 security and IT leaders surveyed in the Cisco report are clear on one point: AD is a foundational infrastructure that they cannot walk away from despite inherent security challenges. So, rather than replace AD, CISOs and their teams are having to harden AD by strengthening the security controls around the legacy authentication infrastructure, making it hard for today's threat actors to exploit known vulnerabilities to gain access and move laterally across the network.

"AD has been in place for 20 years and it’s got 20 years of stuff. People are trying to move away from it, but I don’t know anyone who has. The problem is that there's been so many hands inside of AD that nobody wants to touch what other people did because it’s indecipherable. You end up with foundational pieces built into AD that might not be implemented properly. And, unfortunately, you drag that baggage with you."
-CISO, ecommerce transportation company

Backbone of authentication protocols

These foundational identity systems, passed from owner to owner and relying on older protocols, grow in complexity while inherently lacking security controls like visibility and MFA. Attackers take advantage of these blind spots in the heart of enterprise access, ripe with misconfigurations and accumulated tech debt. So, why not replace AD with newer cloud-based IdP options that are better aligned with today’s modern networks?

It's not that simple. Mandy Andress, now the CISO at AI search company Elastic, has been on both sides of the AD dilemma. In past roles, AD was central to her organizations' identity management strategies—ensuring users had fast, reliable access to resources.

However, in her new role at Elastic, AD was never implemented because it is a new company that didn't inherit legacy identity infrastructure. Andress was able to build the company's identity strategy from scratch, forgoing the Microsoft identity standard in favor of more flexible cloud-based IdP options. While CISOs would love to rip and replace AD, that’s just not practical for established organizations with decades of legacy infrastructure.

"Active Directory has been this backbone of identity for decades, and it would be a significant challenge to remove AD from an existing organization where it is embedded in the network architecture," Andress said. "It would be very, very, very hard—if not impossible—to make that shift."

The reality is that AD isn't going anywhere, and CISOs are under pressure to come up with reliable and efficient ways to defend the vulnerable identity infrastructure.

The Active Directory attack landscape in 2026

The combination of its ubiquitous nature inside legacy infrastructures and the inherent security gaps that often remain unaddressed has made AD a tempting target for today’s threat actors. In fact, 44% of identity-related attacks target AD today, using a variety of tactics and techniques specifically designed to exploit the visibility gaps that exist in the legacy authentication protocol.

Here is a rundown of the most common attack techniques targeting AD:

Kerberoasting is a post-exploitation attack technique that targets service accounts in AD. It exploits the way the Kerberos protocol handles authentication to steal password hashes, which are then cracked offline to gain unauthorized access and escalate privileges. This type of attack does not exploit a software "bug" but rather abuses the legitimate design of the Kerberos protocol, typically using phishing to gain initial access to the network through a low-privileged domain user account. This stealthy attack gives the attacker the "keys to the kingdom" that they can then use to escalate their own privileges and move unfettered across the network. Since the exploit relies on the fundamental way Kerberos was designed and subsequent hacking happens offline on the attacker's own hardware, no logs on the corporate network are created and observable activity looks like legitimate behavior.

A Pass-the-Hash (PtH) attack is a method where an attacker steals a hashed user credential and uses it to create a new authenticated session on the same network, bypassing the need for the user's plaintext password. This access allows the attacker to jump from machine to machine, harvesting additional hashes until they find a Domain Admin or high-privileged account. While Kerberoasting involves cracking a service ticket hash offline to find a password, PtH allows an attacker to use the hash directly as a functional equivalent to a password.

An NTLM Relay attack is a sophisticated Man-in-the-Middle (MitM) technique where an attacker intercepts an authentication attempt from a victim and relays it to a target server. It works by exploiting the three-way "Challenge-Response" handshake used by the NTLM protocol, granting the attacker an authenticated session that gives them the same permissions as the victim on the server, allowing them to install malware or dump more credentials. Unlike PtH, where you steal a stored hash to use later, an NTLM Relay attack happens in real-time. The attacker doesn't need to crack a password or even possess a stored hash. They simply act as a transparent proxy for a legitimate authentication session.

Why Active Directory is vulnerable

Common attack methods are just the beginning of AD vulnerabilities. Less publicized are the challenges unmonitored technical debt can lead to.

The visibility and complexity problem

Most organizations have less-than-ideal visibility into what's in their Active Directory, and that’s a serious problem. After all, it's hard to protect what you can't see.

"Legacy authentication systems like AD are filled with visibility gaps that prevent you from knowing what is going on in your environments," said Nigel Miller, deputy CISO of Maximus. "They provide certain level of access, but you don't really know what that access is and why it may pose a risk."

Years or decades of piecing together disparate AD groups have led to growing technical debt and a rising total cost of ownership. The consequences of these visibility gaps are dormant accounts, over-privileged service accounts, old admin identities, and potential identity drift between on-premises AD and cloud-based IdP protocols. However, it's rarely a priority to achieve continuous visibility of these until it’s too late and a gap is exploited.

To comply with rising security needs, organizations are forced to configure complex workarounds or juggle costly point solution trade-offs.

The compliance and insurance problem

The AD dilemma isn't just about a lack of visibility and complexity. It's also about the mounting pressure from auditors. Increasingly rigid regulations and insurance requirements demand complete security coverage and reportable visibility—especially for privileged and non-human identities. 

"We have the behavior analytics, we have all those tools that are able to attribute who’s doing what to see what is and is not normal and alert and auto-respond. It's the regulatory compliance side that keeps me up at night because they're coming back next year, and they're going to look at this area very closely."
-CISO, regional bank

What modern AD defense looks like

Hardening AD infrastructures is critical to a security-first identity strategy. Here are five tips to get started:

Treat AD as a contemporary attack surface: AD is not going anywhere. Organizations need to acknowledge this first and make a commitment to hardening AD infrastructures as much as their cloud apps—especially given the increased scrutiny of privileged NHI.
Close the visibility gap first: You cannot defend what you cannot see, and most organizations cannot see what's hidden in their on-prem IdPs. Gain visibility into AD infrastructures in conjunction with cloud providers, adding identity security posture management that discovers identity drift, dormant service accounts, over-privileged accounts, and other potential misconfigurations.
Extend MFA to legacy Kerberos and NTLM authentication paths: MFA is an essential security control—and many regulations and insurance premiums require complete coverage. Inserting MFA at the domain controller-level can protect custom or legacy applications that rely on authentication flows without native MFA support.
Audit privileged accounts more aggressively: Over-privileged accounts are the highest-leveraged attack target—for good reason. Breach these, and you have the "keys to the kingdom" that allow you to move laterally across the environment.
Plan for hybrid identity, not AD replacement: The realistic path in 2026 is defending, hardening and modernizing AD infrastructure that is already in place.

Go deeper into CISO Perspectives

AD has emerged as a tempting target for modern threat actors. CISOs from around the world are under pressure to harden AD infrastructure security, using new technologies and solutions to close the visibility gap, reduce complexity, and improve defenses against today’s threat actors.

In the meantime, check out how Cisco Duo can help harden AD infrastructures while reducing technical debt with Active Directory Defense.