Active Directory visibility gaps are still widening NHI risk

At a glance

What this is: This is a vendor analysis of why Active Directory visibility gaps still increase NHI risk, with on-premises service accounts, ownership, and lifecycle gaps at the centre.

Why it matters: It matters because IAM teams cannot govern what they cannot inventory, and in hybrid estates that leaves service accounts, over-permissioned principals, and offboarding gaps exposed across both on-premises and cloud identity planes.

By the numbers:

• The median time-to-AD for all attacks was just 0.68 days, or about 16 hours.
• The use of Impair Defenses rose from 24% in 2021 to 43% in the first half of 2023.

Context

Active Directory remains one of the most important identity control planes in hybrid environments because it still governs users, machines, and non-human identities such as service accounts. In practice, the problem is not just that AD exists on premises, but that ownership, secrets, permissions, and usage change faster than many teams can inventory them.

Token Security argues that this creates a visibility gap, not merely an administration gap. Once service accounts are managed alongside human accounts without strong identity context, teams lose the ability to answer basic governance questions about who owns what, what depends on it, and whether the account is still justified.

The article frames that gap as an NHI issue because service accounts and other non-human identities are central to automation, authentication, and lateral movement risk. In that sense, AD is not only a directory problem but a lifecycle and privilege problem that spans human and machine governance.

Key questions

Q: What breaks when service accounts in Active Directory are not clearly owned?

A: Lifecycle governance breaks first, because no one can confidently attest, rotate, or decommission the account. Without a named owner, service accounts tend to persist after the original application changes, which increases privilege drift and slows remediation. In hybrid environments, that usually means the directory is still working while governance has quietly failed.

Q: Why do attackers focus on Active Directory so early in a breach?

A: Attackers focus on Active Directory early because it is the trust source for authentication and authorization in many environments. Once they reach the directory plane, they can escalate privilege, alter account state, and use trusted access paths to expand laterally. That makes AD a multiplier, not just a target.

Q: How do security teams know if service account governance is actually working?

A: Governance is working when every service account has an owner, a workload, a retirement condition, and an auditable rotation path. Teams should also see reduced stale access, fewer unknown accounts, and fewer secrets stored outside managed controls. If the organisation cannot explain why an account still exists, governance is not yet effective.

Q: What is the difference between a visible AD identity and a governed one?

A: A visible AD identity can be discovered in inventory, but a governed identity has an accountable owner, an understood business purpose, reviewed access scope, and a lifecycle decision attached to it. Visibility tells you the account exists. Governance tells you whether it should still exist and who is responsible for it.

How it works in practice

Why AD ACLs make NHI visibility hard

Active Directory permissions are object-centric, so access is expressed through Access Control Lists on files, folders, and accounts rather than through a simple per-user model. That creates nested complexity because effective access depends on group membership, inheritance, and the context of each object. For NHI governance, the challenge is that service accounts often sit inside this layered structure without clear ownership or a clean inventory of where secrets and privileges are concentrated. Static exports rarely capture the real access path.

Practical implication: build identity discovery around effective access and ownership, not around directory records alone.

Service account lifecycle gaps in hybrid AD and Entra ID

Hybrid estates add another layer of drift because AD identities may be synchronised into Entra ID while remaining governed by different operational teams. That makes offboarding, rotation, and ownership review harder when the same service account touches both on-premises and cloud dependencies. The article’s point is that lifecycle management fails when the account’s usage changes but the control record does not, leaving long-lived access and stale dependencies in place.

Practical implication: reconcile service-account ownership and usage across AD and Entra ID before treating lifecycle controls as complete.

Why attackers move to AD so quickly

The article cites research showing attackers reach AD early because once they control directory infrastructure, they can escalate privileges, disable defenses, and move laterally from a trusted position. AD becomes attractive precisely because it is the central authority for authentication and authorization. If defenders only monitor endpoint activity or individual accounts, they miss the directory-level pivot that turns one compromise into broad identity control.

Practical implication: treat AD as a high-value identity control plane and monitor it as a target, not just a backend directory.

NHI Mgmt Group analysis

Visibility is the control boundary for NHI governance in Active Directory. When organisations cannot see service accounts, ownership, usage, and dependency chains, they are not merely missing data. They are missing the prerequisites for offboarding, privilege review, and accountability. The practical conclusion is that AD identity governance starts with discovery completeness, not with remediation workflows.

Active Directory creates an identity blast radius problem when service accounts are left embedded in hybrid operations. The issue is not only that an account exists, but that it often carries hidden dependencies across servers, applications, and synchronised cloud identities. That makes every stale account a potential multiplier for privilege and recovery risk. Practitioners should treat unmanaged service-account sprawl as a structural exposure, not an isolated misconfiguration.

Directory compromise is a governance failure as much as a security failure. The article shows that attackers value AD because it sits at the intersection of authentication, authorization, and administrative trust. Once that control plane is reached, the organisation’s identity model can be turned against it. The implication is that AD monitoring must be tied to ownership and lifecycle governance, or the directory remains a force multiplier for compromise.

Hybrid identity programmes need one inventory of record for human and non-human access. The article’s strongest signal is that the same directory often holds both people and service accounts, but teams still manage them through different processes. That split creates blind spots in who owns access, what depends on it, and when it can be removed. The practitioner takeaway is to unify identity context before attempting to mature zero standing privilege or recertification programmes.

Ephemeral cloud governance does not solve on-premises NHI exposure. The AD problem persists because service accounts are often long-lived, locally managed, and only partially visible once synchronised into cloud identity layers. That means cloud-first governance can leave the riskiest legacy identities untouched. The field should read this as a warning that hybrid NHI control is only as strong as the least visible directory it depends on.

From our research library:

• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Identity visibility in Active Directory is becoming the baseline control for hybrid NHI governance. When service accounts are managed alongside human users, the first failure is usually not privilege escalation but incomplete inventory. Programmes that cannot link ownership, usage, and dependency data will struggle to enforce offboarding or recertification with any confidence.

Directory-level trust still expands the blast radius of a single compromise. Once AD is treated as the authoritative source for authentication and authorization, compromise of that control plane changes the security posture of the entire estate. Security teams should therefore watch for mismatches between directory state and actual application dependency, because that is where stale access persists.

Visibility debt is now a lifecycle problem, not just a monitoring problem. The same account can survive across on-premises and cloud environments, while responsibility shifts between teams and no one owns the final revocation step. That makes lifecycle reconciliation the next control to mature, not a downstream clean-up task.

For practitioners

• Map every service account to an owner and maintainer Create a single inventory that ties each AD service account to a business owner, technical maintainer, and consuming application. Use that inventory to expose orphaned accounts and stale dependencies before they become offboarding failures.
• Review effective permissions on AD objects Analyse ACLs, nested groups, and inherited rights to determine the real access path for service accounts and privileged principals. Focus on where permissions are granted indirectly, because those paths usually hide the largest blast radius.
• Identify long-standing and unrotated credentials Prioritise service accounts whose passwords or secrets have not changed in a long time, especially where they can reach critical servers or directories. Long-lived credentials are the most likely bridge from visibility gaps to compromise.
• Synchronise AD and Entra ID governance views Compare on-premises AD accounts with their cloud synchronised counterparts so ownership, access scope, and lifecycle state do not drift between environments. If the same account is managed in two places, make sure one source of truth exists for remediation.
• Monitor AD as a high-value control plane Treat abnormal changes in domain admin membership, defense settings, and service-account behaviour as directory-level indicators rather than isolated events. The goal is to catch identity compromise before it becomes lateral movement across the estate.

Key takeaways

• Active Directory visibility gaps turn service accounts into unmanaged access paths, especially when ownership and dependency data are incomplete.
• The article cites Sophos data showing attackers reach AD in 0.68 days, or about 16 hours, which shows how quickly directory compromise can shape the rest of the intrusion.
• The control that matters most is not just monitoring, but complete lifecycle governance for service accounts across on-premises and cloud identity planes.

Key terms

• Active Directory exposure: The set of directory conditions that increase the chance of unauthorized access or privilege expansion. This includes stale accounts, inherited permissions, nested groups, and misconfigured delegation. Exposure matters because directory structure can quietly multiply risk even when no single account looks obviously dangerous.
• Service Account Lifecycle: Service account lifecycle refers to the creation, use, review, rotation, and retirement of non-human identities that support applications or infrastructure. The key governance question is whether each account remains tied to a current business purpose and a named owner.
• Directory control plane: The identity layer that determines how authentication, authorisation, and administrative trust are enforced across users and non-human accounts. When Active Directory is the control plane, compromise or misgovernance can affect many downstream systems at once, which is why directory visibility becomes a security boundary.
• Identity Graph: An identity graph is a relationship map that connects identities, assets, data, and permissions so teams can see how access actually flows. In NHI programmes, it helps explain which agent is related to which owner, which system, and which policy boundary.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.