Hybrid identity security scores expose persistent assessment gaps

At a glance

What this is: This is Semperis’ 2025 Purple Knight report, which shows persistent gaps in hybrid identity assessment across Active Directory, Entra ID and Okta, with an average score of 61 out of 100.

Why it matters: For IAM and identity practitioners, the finding matters because weak assessment and uneven remediation leave hybrid identity estates exposed even when tooling exists to surface the problems.

By the numbers:

• The average score of 61 out of 100 is 11 points lower than the average score of 72 in the 2023 report.
• Organisations applying Purple Knight’s remediation guidance reported an average improvement of 21 points, and as high as 61 points.
• Organizations with between 2,001 and 5,000 employees averaged a score of 52, the worst overall.

Context

Hybrid identity security is the governance problem created when Active Directory, Entra ID and Okta must be assessed and remediated as one operating surface rather than three separate products. The report argues that organisations still cannot see enough of that surface to close exposure consistently.

The primary issue here is not assessment tooling in the abstract. It is whether identity teams can turn scan results into remediation action across environments where ownership, complexity and resource constraints differ sharply.

Semperis’ findings make the point that lower scores are not just a maturity signal. They are an indicator that identity risk persists when visibility, prioritisation and fix execution are not aligned.

Key questions

Q: Why do hybrid identity assessments keep missing important vulnerabilities?

A: They miss them when teams treat Active Directory, Entra ID and Okta as separate silos instead of one governed identity surface. In that model, gaps at the seams are easy to overlook, and no single owner feels responsible for closure across the whole path.

Q: What should IAM teams do first when hybrid identity scores are low?

A: Start by building a single remediation backlog that assigns every finding an owner, a due date, and a retest step. Low scores become actionable only when assessment results move into a tracked closure process rather than remaining in a report.

Q: What signals show that hybrid identity remediation is actually working?

A: The strongest signal is sustained improvement across multiple assessment cycles, not a one-time score jump. Teams should look for shrinking exposure in AD infrastructure, account security, and trust categories, plus documented ownership for each fix. If scores rise but recurring issues stay the same, the programme is only partially working.

Q: What is the difference between hybrid identity assessment and hybrid identity remediation?

A: Assessment finds exposure, while remediation removes it. In hybrid identity environments, the distinction matters because repeated scanning without closure only measures technical debt, whereas remediation changes the actual attack surface across directories and identity providers.

Technical breakdown

Why hybrid identity visibility breaks down across AD, Entra ID and Okta

Hybrid identity environments combine on-prem Active Directory, cloud identity, and federated access paths, so assessment has to correlate exposures across multiple control planes. When teams treat each directory or IdP as a separate island, they miss cross-domain issues such as inconsistent policy inheritance, stale administrative paths, and incomplete exposure mapping. The report’s category spread shows that infrastructure and account controls remain the hardest to score well because they sit closest to the seams between systems.

Practical implication: assess hybrid identity as one governed surface, not as three independent consoles.

Why remediation guidance matters more than raw scoring

A score is only useful if it changes operator behaviour. Purple Knight’s result set shows that users can materially improve results after applying expert mitigation guidance, which means the real gap is not discovery but prioritisation and closure. In identity programmes, assessment without follow-through often becomes reporting theatre: the organisation knows the weakness exists, but the operational path to remove it is unclear or unowned.

Practical implication: pair every assessment cycle with a named remediation owner and a closure deadline.

Why midsized environments often score worst

Midsized organisations often sit in the worst position for hybrid identity security because they have enough complexity to accumulate technical debt, but not enough dedicated staff to maintain specialist controls. That produces the classic governance gap: the environment is complex enough to be dangerous, yet not resourced enough to receive continuous attention. In practice, the issue is less absence of knowledge than absence of capacity to execute remediation at pace.

Practical implication: prioritise control fixes that reduce recurring manual effort in midsized estates.

Threat narrative

Attacker objective: The attacker aims to turn identity blind spots into durable access across the hybrid environment and use that access for disruption, theft, or broader compromise.

1. Entry begins when attackers exploit weak visibility across hybrid identity systems, especially where Active Directory, Entra ID, and Okta are managed as disconnected control planes.
2. Credential access and misuse become easier when account security, Kerberos, and infrastructure gaps remain unremediated, because privileged paths and trust relationships stay exposed.
3. Impact follows when hidden identity weaknesses allow attackers to persist, move across environments, or disrupt authentication and administrative control.

Breaches seen in the wild

• Storm-0501 hybrid cloud attacks 2024: Ransomware affiliate Storm-0501 stole Entra Connect Sync credentials to move from on-prem AD to Entra ID, then forged tokens via a rogue federated domain.
• Okta support system breach 2023: A support service account credential saved in a personal Google profile let attackers take HAR files and hijack five Okta customers' sessions.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Hybrid identity assessment gaps are a governance failure, not a tool failure. Organisations already have ways to scan Active Directory, Entra ID and Okta, but the report shows that visibility alone does not produce closure. The discipline gap is in turning findings into accountable remediation across multiple identity planes. Practitioners should treat scorecards as governance inputs, not as proof of control.

Score improvement after guidance proves that remediation is the limiting factor. The report’s 21-point average uplift shows that many hybrid identity weaknesses are actionable once they are surfaced in a usable form. That is a strong signal that the weak point is operational follow-through, especially where ownership spans infrastructure, account security and directory-specific teams. The practical conclusion is that assessment must be tied to remediation workflow, not periodic review.

Hybrid identity programmes need a single remediation model for a multi-system estate. Active Directory, Entra ID and Okta are not interchangeable, but they are operationally coupled in ways that make isolated assessment misleading. A named concept here is hybrid identity remediation drift: the gap between finding a vulnerability and actually closing it across the systems that share trust. That drift is what allows low scores to persist even when assessments are repeated.

Midsized enterprises are where identity debt becomes most visible. The report’s weakest scores in the 2,001 to 5,000 employee range align with the reality that these organisations have complexity without deep specialist capacity. That combination makes it easy for gaps to stay open longer than they should. Practitioners in this segment need to prioritise closure mechanics, not just additional detection.

Hybrid identity governance should be measured by closure velocity, not assessment volume. Repeated scans matter only if they reduce the time between exposure discovery and fix deployment. The report suggests that organisations improve when they can translate findings into action, so the right programme question is whether remediation is happening faster than new exposure accumulates. Identity teams should judge maturity by how quickly they can remove known gaps.

From our research library:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Hybrid identity programmes fail when assessment results stay inside reporting cycles and never become owned remediation work. The report’s pattern suggests that the practical control gap is closure velocity, not discovery volume.

Hybrid identity remediation drift: the delay between identifying a weakness and actually removing it grows quickly when Active Directory, Entra ID and Okta are governed by separate teams. That drift is where repeated low scores become normalised rather than corrected.

The fact that users improved by an average of 21 points after applying guidance suggests that many identity exposures are fixable once the work is operationalised. According to the 2024 State of Secrets Management Survey, the average time to mitigate a leaked secret is 36 hours, and that same operational discipline is what hybrid identity remediation often lacks.

For practitioners

• Map hybrid identity to one remediation queue Create a single backlog for Active Directory, Entra ID and Okta findings so ownership does not fragment across platforms and teams.
• Assign closure owners to each assessment category Give infrastructure, account security, Kerberos, Group Policy, Entra ID and Okta findings explicit remediation owners and target dates.
• Use score deltas to prioritise high-friction gaps Focus first on weaknesses that keep recurring across assessments, because those indicate process or ownership failures rather than isolated technical defects.
• Validate remediation against the live environment Re-test fixed findings after each change so score improvement reflects actual closure rather than documentation updates or partial mitigation.

Key takeaways

• Hybrid identity risk persists when assessment and remediation are not governed as one process across Active Directory, Entra ID and Okta.
• The report shows that organisations can raise scores materially after applying remediation guidance, which means execution discipline is the real bottleneck.
• Identity teams should measure success by closure speed, retest outcomes and ownership clarity, not by scan frequency alone.

Key terms

• Hybrid Identity: Hybrid identity is an architecture that connects on-premises directories with cloud identity providers and SaaS applications. It creates operational flexibility, but it also expands the blast radius of identity compromise across multiple systems that share trust and authentication dependencies.
• Assessment Score: An assessment score is a numeric measure of how well an identity environment meets a set of security checks at a point in time. It is useful only when paired with remediation actions, because the score describes current exposure rather than whether the control environment is actually improving.
• Remediation Guidance: Remediation guidance is the practical instruction set that explains how to fix a security issue after it has been identified. It usually includes the affected setting, the recommended change, and any dependencies or licensing considerations. Good guidance turns a finding into an actionable task instead of a vague alert.
• Identity Exposure Path: An identity exposure path is the sequence of systems, permissions, and trust relationships that can be used to reach sensitive identities or their privileges. It describes how an attacker, insider, or misconfiguration could move from one identity control point to another, revealing where identity risk becomes exploitable across accounts, tokens, sessions, and access policies.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.