For years, Active Directory (AD) has been the gold standard for identity and access management. It’s embedded in the DNA of enterprise IT, the engine behind logins, device authentication, and the digital workplace. But as cyber attackers grow more sophisticated, many CISOs are asking a difficult but necessary question:
Can we still trust Active Directory as the foundation of our security architecture?
It’s not that AD itself is broken. It’s that the model around it, and how most organizations secure it, is no longer sufficient for the threats we now face.
AD was built for a different era. A time when users were inside the network, devices were trusted by default, and attacks came from the outside. But today’s reality is radically different:
While AD is essential for most organisations, it’s also dangerously exposed.
CISOs aren’t losing trust in AD security; they’re losing confidence in the assumptions that underpin it.
In a high-profile ransomware attack on a British business earlier this year, it’s been suggested that attackers used stolen credentials to exfiltrate the AD database, move laterally across the network, and deploy ransomware. If this is the case, the attackers didn’t need to break AD; they simply exploited its inherent openness.
Other UK retailers were also hit in similar campaigns. While each incident varied in severity, in every case, attackers targeted AD because once it’s compromised, every system, user, and asset downstream is exposed.
Firewalls, VPNs, Conditional Access, and endpoint detection all play a role. But they operate on the assumption that what happens inside the network is inherently safe.
AD traffic is often left unprotected or encrypted in ways that can still be decrypted by attackers already inside the network. VPNs and VLANs segment traffic, but they don’t cloak it. TLS may encrypt it, but with keys on endpoints or in memory, attackers can extract and decrypt it later.
The idea of implicit trust in the network, in endpoints, or even in users has eroded. CISOs are shifting toward zero trust models, but many overlook the one system that should never be implicitly trusted: Active Directory.
Zero trust means nothing gets access without verification. But how often is AD traffic itself verified? How often is its visibility controlled? How do you prove that AD policy enforcement hasn’t been tampered with?
That’s why forward-thinking CISOs are rethinking Active Directory security, not at the identity level, but at the traffic level.
Certes Data Protection and Risk Mitigation (DPRM) offers a new approach. By applying cryptographic segmentation and deterministic policies to AD traffic, Certes ensures:
This turns AD from a soft target into a hardened, cloaked system that can’t be exploited, even if an attacker is already in the network.
Rethinking trust in AD isn’t about abandoning a cornerstone of enterprise IT. It’s about recognising that the trust model must evolve as threats change.
AD will always be central to identity. But it shouldn’t be a blind spot.
CISOs who assume breach, segment critical services, and enforce traffic-level controls are the ones who recover faster, protect their data, and pass audits when the inevitable cyber incident occurs.
If AD traffic is visible, it’s vulnerable. If it’s vulnerable, it’s a liability. That’s why security leaders should be asking, “Who can see our AD, who can use it, and how can we make sure they can’t abuse it?”
Certes DPRM gives them the answer.
Learn how Certes protects Active Directory with zero-access, post-quantum ready enforcement.
Request a meeting or speak to our team.