Topic starter
11/07/2026 1:58 pm
TL;DR: Compromised passwords are rising from about 14% of accounts in 2024 to roughly 19% in 2025, while unsafe credentials crossed 22%, according to Enzoic’s AD Lite scan data. This reinforces the Verizon DBIR finding that credential abuse is the leading initial access vector, and password exposure is now a continuous identity problem, not a one-time hygiene issue.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “Rising Risk of Compromised Credentials in AD”.
By the numbers:
- Compromised-password exposure rose from about 14% of accounts in 2024 to roughly 19% in 2025.
- Unsafe credentials crossed the one-in-five mark in 2025, reaching about 22% of accounts per domain.
- AD Lite domain scans averaged 1,014 users in 2025.
Key questions
Q: What breaks when Active Directory passwords are exposed outside the environment?
A: Native password policy breaks down because it can only judge whether a credential matches local rules, not whether attackers already know it.
Q: Why do compromised passwords still matter if users have not changed their behaviour?
A: They matter because breach datasets keep expanding, so a password can become risky long after it was set.
Q: How do security teams know if password lifecycle control is actually working?
A: Look for centralized logging, repeatable reset orchestration, consistent policy enforcement across systems, and the ability to execute and verify recovery without manual cross-platform coordination.
Practitioner guidance
- Baseline directory exposure continuously Run recurring scans for compromised, weak, and reused passwords so exposure is measured as an ongoing state rather than a one-off event.
- Prioritise stale accounts for review Flag inactive accounts that still have valid credentials and route them into lifecycle cleanup before they become quiet takeover targets.
- Enforce remediation for exposed credentials Connect detection to mandatory password reset or account restriction workflows when a credential appears in breach datasets.
Bottom line: Compromised and unsafe passwords are rising in Active Directory, which turns password exposure into a live governance problem rather than a static hygiene issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:08 pm
Active Directory password exposure is now a lifecycle problem, not a hygiene problem: The article shows that compromised credentials are rising even without a corresponding collapse in user behaviour. That means the control gap is persistence, where breached passwords remain viable long enough to be reused. Practitioners should treat exposure as an ongoing identity-state issue, not as a one-time password reset campaign.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
A question worth separating out:
Q: Should organisations prioritise exposed-password cleanup over broader identity hardening?
A: Yes, when the environment still has a meaningful population of compromised or weak passwords, because credential abuse remains a direct path to initial access. Broader identity hardening still matters, but exposed passwords are a near-term breach multiplier and should be removed from circulation first.
👉 Read our full editorial: Active Directory credential risk is rising as exposed passwords spread