The rules of cybersecurity have evolved for both enterprises and government agencies. The perimeter is no longer the network; it is identity. Despite significant investments in securing endpoints, cloud workloads, and infrastructure, attackers continue to succeed by exploiting the one control plane that connects them all. Active Directory (AD) and Entra ID are at the center of how many organizations manage access to critical systems, applications, and data. Because of that, they are also among the most attractive targets for attackers.
The scale of the problem is hard to ignore. Since AD remains the primary identity store for about 90 percent of businesses worldwide, compromising the directory can give an attacker access to the entire environment rather than just one system. The pattern appears repeatedly in major incidents: rather than endpoint malware, the common thread is identity material that has been stolen or forged, like credentials and tokens. Attackers who specialize in AD often have a deeper understanding of its architecture than the teams protecting it.
The Visibility Problem
What security teams cannot see cannot be fixed. Most organizations treat AD as stable infrastructure, allowing users to create accounts, add groups, and grant permissions. However, each “temporary” permission, every exception, and every legacy service account adds weight. As a result, there is a growing gap between an organization’s assumed security posture and its actual posture, which is only visible when an audit, an assessment, or an adversary exposes it.
Government agencies are especially affected by this. Public sector IT environments often rely on legacy systems with unpatched vulnerabilities and misconfigurations. Many agencies have built identity and access management programs incrementally, with disconnected legacy systems that created operational blind spots and governance gaps. The more fragmented the infrastructure, the more misconfigurations accumulate – a dynamic that applies equally to any organization where identity management has evolved without central governance rather than as a coordinated whole.
From Assumptions to Evidence
To close this gap, identity infrastructure must be treated as a dynamic attack surface that necessitates continuous, objective measurement rather than something that is assumed to be secure because it hasn’t failed yet.
Organizations can move from believing their identity environment is secure to having evidence of where it actually stands with the help of independent assessment tools.
One example is Purple Knight, a free assessment tool from Semperis that scans hybrid Active Directory, Entra ID, and Okta environments for indicators of exposure and indicators of compromise. Purple Knight was cited as a recommended tool in the Five Eyes joint advisory, Detecting and Mitigating Active Directory Compromises, which was co-authored by the U.S. National Security Agency, CISA, and partner agencies. The tool provides assessment scores and prioritized guidance to help identify and remediate weaknesses.
A scan is not a complete defense; rather, it is a diagnostic baseline. It doesn’t replace a comprehensive security strategy, and it still requires ongoing governance, monitoring, and remediation to close the gaps it identifies. The organizations best positioned to defend identity infrastructure in the coming years won’t be those with the biggest budgets or most tools. They will be the ones who are willing to measure their true exposure and take action on what that measurement reveals.