Topic starter
22/06/2026 9:55 am
TL;DR: Active Directory remains a primary nation-state attack path for U.S. government agencies, while Semperis’s federal appointment and procurement expansion aim to strengthen identity resilience and crisis response across defense and civilian environments, according to Semperis. The real issue is not a staffing change but the widening gap between legacy identity infrastructure and modern identity-first attack pressure.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Semperis Appoints Jimmy McNary as Deputy Federal CTO to Drive Identity Security Strategy Across the Public Sector”.
Key questions
Q: What breaks when Active Directory is compromised or unavailable?
A: When Active Directory fails, organisations can lose sign-in, authorisation, delegated administration, and sometimes even recovery paths.
Q: Why do federal identity resilience programmes need recovery planning, not just prevention?
A: Prevention alone is insufficient when the identity control plane can be altered, encrypted, or taken offline.
Q: What signs show that an ICAM programme is not resilient enough?
A: Warning signs include over-reliance on a single directory trust source, no tested restoration path for privileged access, and incident response plans that assume the identity platform remains healthy.
Practitioner guidance
- Reassess AD as a resilience-critical control plane Inventory which business and security functions still depend on Active Directory for authoritative trust, and rank them by recovery impact if directory state is altered or unavailable.
- Test identity recovery under degraded conditions Run restoration exercises that assume compromised domain controllers, broken trust paths, or unavailable primary management systems so teams can prove they can re-establish trusted identity control.
- Align ICAM controls to recovery outcomes Map identity lifecycle, authentication, privileged access, and monitoring controls to the point where they support containment and restoration, not only steady-state administration.
Bottom line: The article shows that federal identity risk is no longer just about access control. It is about whether agencies can recover trusted identity state after an attack on the directory layer.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:35 am
Federal identity resilience has become a directory recovery problem as much as a prevention problem. The article is a reminder that agencies cannot treat identity security as a perimeter issue when Active Directory remains the backbone of trust. If attackers can control directory state, the organisation loses not only authentication confidence but also the ability to reliably restore it. Practitioners should frame resilience as the ability to re-establish trusted identity control after compromise, not just to block the first intrusion.
A question worth separating out:
Q: How should agencies decide whether procurement changes improve identity security?
A: Procurement only improves identity security if it shortens the time to measurable control coverage. Agencies should ask whether a buying vehicle expands access to identity recovery, privileged access, and Zero Trust capabilities, or merely makes purchasing easier without changing resilience outcomes.
👉 Read our full editorial: Semperis federal identity resilience strategy raises the stakes