Coexistence increases risk because the source and target forests must interact while trust relationships, synchronisation, and legacy access are still active. That overlap creates an opportunity for attackers to move from an already compromised source into the new environment. The risk is highest when isolation, monitoring, and removal criteria are weaker than the temporary connectivity they are meant to control.
Why coexistence periods are uniquely risky in Active Directory migrations
Coexistence is not a neutral transition state, it is a blended trust zone. During an active directory project, the source forest, target forest, synchronisation path, delegated admin roles, and legacy access often remain connected long enough to widen the attack surface. That overlap matters because compromise in the old environment can become a path into the new one.
Temporary connectivity also tends to outlive its original security assumptions. Controls that were acceptable for migration convenience, such as broad trust, special sync permissions, or exceptions for legacy apps, can become the exact conditions an attacker needs to pivot, persist, or re-establish access after initial compromise.
For practitioners, the critical question is not whether coexistence is necessary, but whether the temporary bridge is smaller, more observable, and easier to remove than the risk it introduces. If not, the migration is creating a second production attack path rather than replacing the first one.
How attackers use the overlap between old and new directories
Attackers look for the weakest shared control surface, not the cleanest architectural diagram. In coexistence periods that usually means trust relationships, synchronisation accounts, directory replication rights, or legacy service principals that still operate across both sides. Once one side is compromised, those relationships can expose the target forest to credential replay, token abuse, or lateral movement.
This is why directory migration risk often looks like privilege and boundary failure rather than a pure implementation defect. The migration introduces a period where the environment has more routes to valuable identity material, more privileged exceptions, and more places where monitoring is incomplete. Guidance on Active Directory and Entra ID hardening is especially relevant here because tiering, privileged group design, delegation, and hybrid identity controls all shape how much blast radius coexistence can create.
That same overlap is why compromise can move from “old” to “new” faster than teams expect. Storm-0501 hybrid cloud attacks 2024 shows the practical danger of sync credentials and federated trust being used as a bridge into the target environment. The lesson is that migration plumbing becomes part of the attack path when it is allowed to keep more privilege than the migration strictly needs.
Legacy dependencies add another layer of exposure. Old applications, service accounts, and authentication exceptions often remain active because they are hard to modernise on schedule. A migration that leaves those dependencies in place can preserve stale trust decisions inside the new model, which is why lifecycle discipline is central to NHI lifecycle management even when the immediate project is framed as an AD move rather than a secret or account lifecycle project.
What good migration control looks like before coexistence ends
Good coexistence control is defined by explicit exit conditions, not by elapsed time. You should know which trusts will exist, which identities are allowed to span both forests, what logging will prove the bridge is still behaving as expected, and what event triggers removal of each temporary exception.
The safest migrations treat coexistence as a constrained state with measurable blast-radius limits. That means scoping sync accounts narrowly, avoiding unnecessary bidirectional trust, separating administrative planes, and confirming that legacy access is still required at each review point. If you cannot explain why a cross-forest path still exists, it is usually a candidate for removal rather than retention.
Migration teams also need to watch for credential reuse and stale administrative paths. Cisco Active Directory credentials leak 2025 is a reminder that directory material, service accounts, and hash exposure can remain valuable long after the original event. In a coexistence phase, any leaked or overexposed credential with cross-environment reach becomes disproportionately dangerous.
When coexistence is unavoidable, the practical goal is to make the bridge auditable and disposable. The State of NHI & AI Agent Breach Report 2026 is useful background because it reinforces a recurring pattern: attackers often weaponise identity material and trust paths before defenders fully retire them. The same pattern applies to AD migrations when temporary access becomes permanent by default.
Risk and Threat Considerations
Coexistence periods increase breach risk because they combine active trust with incomplete separation. That creates a window where the attacker only needs to compromise one side, then use the migration bridge, sync path, or legacy exception to reach the other side before controls are fully normalised.
Failure mechanism: Temporary trusts, elevated sync permissions, and legacy access routes stay active after the migration has started, giving an intruder a realistic pivot path from a weaker source environment into the target forest.
Impact: A compromise can spread across both environments, increasing the chance of domain-level persistence, credential exposure, and delayed detection while teams still believe the project boundary provides isolation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021 — Remote Services | Coexistence creates pivot paths attackers can abuse between forests. |
| Recommendation — Map cross-forest pivots to lateral-movement techniques and hunt for unexpected remote access. | ||
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | Migration coexistence depends on limiting flows between old and new directories. |
| AC-6 — Least Privilege | Temporary migration accounts often retain excessive rights across both environments. | |
| IA-5 — Authenticator Management | Sync and legacy access rely on credentials that must be rotated and retired cleanly. | |
| Recommendation — Enforce explicit information-flow boundaries for temporary trust and sync paths. Reduce migration and sync accounts to the minimum permissions required. Rotate and retire migration credentials as soon as coexistence no longer requires them. | ||
Practitioner Guidance
What to prioritise: Treat every coexistence dependency as a time-bounded exception with an owner, a removal date, and a measurable reason to exist. The first things to tighten are cross-forest trusts, sync credentials, and any administrative path that can touch both environments.
What to verify: Confirm that monitoring covers the bridge itself, not just the endpoints on either side. You should be able to prove which accounts replicate, which systems trust each other, and when each legacy dependency will be revoked or revalidated.
Practitioner takeaway: The migration risk is rarely the coexistence period itself, it is the failure to shrink, observe, and retire the temporary trust fast enough for attacker use.
Related resources from NHI Mgmt Group
- Why does Active Directory migration increase identity risk during coexistence?
- Why does staying on older Active Directory versions increase breach risk for enterprise identity environments?
- How should teams reduce risk during Active Directory migration projects?
- Why does Active Directory Certificate Services increase identity risk?