Active Directory credential risk is rising as exposed passwords spread

At a glance

What this is: This is Enzoic’s analysis of rising Active Directory password exposure, showing that compromised and unsafe credentials became more common from 2024 to 2025.

Why it matters: It matters because AD password compromise still feeds initial access, and IAM teams need continuous visibility into exposed, weak, stale, and reused credentials rather than periodic snapshot scans.

By the numbers:

• Compromised-password exposure rose from about 14% of accounts in 2024 to roughly 19% in 2025.
• Unsafe credentials crossed the one-in-five mark in 2025, reaching about 22% of accounts per domain.
• AD Lite domain scans averaged 1,014 users in 2025.
• The average compromised-password rate was about 19%, equal to 196 compromised-password users out of 1,014 users per domain.

Context

Active Directory credential risk describes the exposure created when passwords are already known to attackers, easy to guess, or reused across accounts. Enzoic’s AD Lite data suggests that this exposure is widening even when password choices do not necessarily get worse year over year, because breach datasets keep growing and stale accounts remain in circulation.

For IAM and identity security teams, the problem is not only password hygiene. It is the combination of compromised passwords, weak passwords, inactive accounts, and limited visibility between periodic checks. In practice, that turns identity compromise into a standing control problem, not a one-time cleanup exercise.

Key questions

Q: What breaks when Active Directory passwords are exposed outside the environment?

A: Native password policy breaks down because it can only judge whether a credential matches local rules, not whether attackers already know it. Once a password appears in breach lists, malware logs, or reuse ecosystems, the directory may still accept it as valid. That means attack success can come from legitimate authentication, not from weak-password guessing.

Q: Why do compromised passwords still matter if users have not changed their behaviour?

A: They matter because breach datasets keep expanding, so a password can become risky long after it was set. The identity problem is temporal: the credential may have been safe when issued, but it becomes unsafe when it appears in leaked data. Governance has to track that changing state.

Q: How do security teams know if password lifecycle control is actually working?

A: Look for centralized logging, repeatable reset orchestration, consistent policy enforcement across systems, and the ability to execute and verify recovery without manual cross-platform coordination. If the team cannot prove who changed what, where, and when, the lifecycle control is still fragmented.

Q: Should organisations prioritise exposed-password cleanup over broader identity hardening?

A: Yes, when the environment still has a meaningful population of compromised or weak passwords, because credential abuse remains a direct path to initial access. Broader identity hardening still matters, but exposed passwords are a near-term breach multiplier and should be removed from circulation first.

Technical breakdown

Why compromised Active Directory passwords keep reappearing

Compromised passwords keep reappearing because breach datasets create a reusable credential pool that attackers can test against enterprise directories. When users keep the same password for long periods, a password exposed elsewhere can remain valid in Active Directory until it is detected and changed. Weak passwords make the problem worse because they can be guessed or cracked even when they have not appeared in a breach. The technical issue is persistence of exposure, not just initial compromise. Practical implication: treat password exposure as a continuously changing state and not as a one-time remediation event.

Practical implication: move exposure checking to a continuous cadence, not a quarterly snapshot.

Why stale accounts increase credential risk

Stale or inactive accounts widen the attack surface because they often escape normal user attention and are less likely to be remediated quickly. If such accounts still have valid credentials, they become attractive targets for password spraying, replay of breached passwords, or opportunistic account takeover. Even a relatively small population of dormant accounts can distort risk because those identities may not be monitored as closely as active users. Practical implication: identify inactive accounts as a credential-risk class, not just an offboarding housekeeping issue.

Practical implication: tie stale-account remediation to identity lifecycle controls and access reviews.

How continuous monitoring changes the control model

Periodic password checks tell you where exposure existed at scan time, but they do not stop new breach data from creating fresh risk tomorrow. Continuous monitoring changes the control model by making exposure visibility ongoing, so compromised or weak credentials can be identified as soon as they enter the risk set. That matters in Active Directory because the identity layer is highly reusable and often linked to broad internal access. Practical implication: align detection, remediation, and lifecycle governance so exposure is not left to drift between scans.

Practical implication: connect monitoring outputs to enforced remediation and account review workflows.

Threat narrative

Attacker objective: The attacker wants a valid directory identity that can be reused for unauthorized access, lateral movement, or broader compromise.

1. Entry begins when attackers use compromised or guessed passwords that already map to valid Active Directory accounts.
2. Escalation follows when weak, reused, or stale credentials provide access paths that were never removed from the directory.
3. Impact occurs when account takeover gives the attacker a trusted identity that can be used for further intrusion or breach staging.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Active Directory password exposure is now a lifecycle problem, not a hygiene problem: The article shows that compromised credentials are rising even without a corresponding collapse in user behaviour. That means the control gap is persistence, where breached passwords remain viable long enough to be reused. Practitioners should treat exposure as an ongoing identity-state issue, not as a one-time password reset campaign.

Standing credential assumptions are breaking under continuously expanding breach datasets: Password governance was designed for a world where exposure could be contained by periodic checks and user education. That assumption fails when the same credential can surface in new breach corpora long after issuance. The implication is that identity programmes need continuous detection and enforced remediation, not reliance on static policy reminders.

Inactive accounts are hidden credential risk amplifiers: The article links stale accounts to a larger share of vulnerable users, which is exactly how dormant identity debt becomes breach-ready identity debt. Accounts that are no longer in active use often escape attention while still retaining valid access. Practitioners should classify inactivity as a control signal, not just an HR or help-desk cleanup issue.

Credential abuse remains the shortest path from identity exposure to breach impact: Verizon’s finding on initial access aligns with Enzoic’s data showing more accounts carrying unsafe credentials. Together, they show why the identity perimeter is still defined by password reuse, breach exposure, and slow revocation. The field should stop treating password security as a narrow authentication topic and start treating it as a core breach-prevention control.

Continuous monitoring creates the only defensible operating model for exposed credentials: Snapshot-based reviews can prove the environment was safe yesterday, but they cannot prove it stayed safe after new breach data emerged. That makes continuous visibility the baseline for modern directory governance. Practitioners should assume exposure will recur and build operational response around that assumption.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
• Read next: API Key Management Guide

What this signals

Credential exposure now behaves like recurring identity debt: Once a password has appeared in breach data, the risk does not expire on its own. The operational question is no longer whether a password was ever compromised, but whether the organisation can detect and retire it before attackers turn it into access.

Continuous visibility matters because exposure grows between reviews, not only at the time of the scan. If directory governance depends on periodic snapshots, the programme will always lag the credential threat it is trying to measure.

For practitioners

• Baseline directory exposure continuously Run recurring scans for compromised, weak, and reused passwords so exposure is measured as an ongoing state rather than a one-off event.
• Prioritise stale accounts for review Flag inactive accounts that still have valid credentials and route them into lifecycle cleanup before they become quiet takeover targets.
• Enforce remediation for exposed credentials Connect detection to mandatory password reset or account restriction workflows when a credential appears in breach datasets.
• Reduce reliance on password-only trust Where possible, reduce the number of high-value accounts that depend on passwords alone and tighten authentication around privileged access paths.

Key takeaways

• Compromised and unsafe passwords are rising in Active Directory, which turns password exposure into a live governance problem rather than a static hygiene issue.
• The article’s data shows that more than one in five scanned accounts carried unsafe credentials in 2025, so the exposed surface is broad enough to matter operationally.
• Continuous monitoring, stale-account cleanup, and enforced remediation are the controls that reduce the window in which known credentials can still be used.

Key terms

• Compromised Credentials: Compromised credentials are login details that an attacker has obtained and can use to access accounts without permission. They often come from phishing, password reuse, malware, or data exposure. Once stolen, they can bypass normal front-door defenses unless organisations add strong authentication, session controls, and access restrictions.
• Stale Account: A stale account is an identity that still exists and may still authenticate, but no longer has a valid business purpose. In NHI programmes, stale accounts often outlive the workload or team that created them, leaving residual access that should be removed or tightly constrained.
• Password reuse: Password reuse is the practice of using the same password across multiple accounts. It turns one successful compromise into a much larger account takeover problem because the attacker can try the stolen credential elsewhere, widening the blast radius beyond the original target.
• Continuous exposure monitoring: Continuous exposure monitoring is the practice of tracking changes in security posture as they happen rather than relying on periodic assessments. In supply chain contexts, it helps detect new services, weak certificates, exposed credentials, and remediation lag before those issues become incidents.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.