Topic starter
11/07/2026 1:58 pm
TL;DR: Unsafe credentials crossed 22% in 2025 and compromised passwords climbed from about 14% of accounts in 2024 to roughly 19%, according to Enzoic. Active Directory now needs continuous monitoring and cleanup because known passwords can stay usable long after they are exposed.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “Rising Risk of Compromised Credentials in AD”.
By the numbers:
- Compromised-password exposure rose from about 14% of accounts in 2024 to roughly 19% in 2025.
- Unsafe credentials crossed the one-in-five mark in 2025, reaching about 22% of accounts per domain.
- AD Lite domain scans averaged 1,014 users in 2025.
Key questions
Q: Why do compromised passwords still matter if users have not changed their behaviour?
A: They matter because breach datasets keep expanding, so a password can become risky long after it was set.
Q: How do security teams know if password lifecycle control is actually working?
A: Look for centralized logging, repeatable reset orchestration, consistent policy enforcement across systems, and the ability to execute and verify recovery without manual cross-platform coordination.
Q: What breaks when Active Directory passwords are exposed outside the environment?
A: Native password policy breaks down because it can only judge whether a credential matches local rules, not whether attackers already know it.
Practitioner guidance
- Baseline directory exposure continuously Run recurring scans for compromised, weak, and reused passwords so exposure is measured as an ongoing state rather than a one-off event.
- Prioritise stale accounts for review Flag inactive accounts that still have valid credentials and route them into lifecycle cleanup before they become quiet takeover targets.
- Enforce remediation for exposed credentials Connect detection to mandatory password reset or account restriction workflows when a credential appears in breach datasets.
Bottom line: Compromised and unsafe passwords are rising in Active Directory, which turns password exposure into a live governance problem rather than a static hygiene issue.
Glossary terms: Compromised Credentials, Stale Account, Password reuse, Continuous exposure monitoring
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
11/07/2026 2:08 pm
Active Directory password exposure is now a lifecycle problem, not a hygiene problem: The article shows that compromised credentials are rising even without a corresponding collapse in user behaviour. That means the control gap is persistence, where breached passwords remain viable long enough to be reused. Practitioners should treat exposure as an ongoing identity-state issue, not as a one-time password reset campaign.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
A question worth separating out:
Q: Should organisations prioritise exposed-password cleanup over broader identity hardening?
A: Yes, when the environment still has a meaningful population of compromised or weak passwords, because credential abuse remains a direct path to initial access. Broader identity hardening still matters, but exposed passwords are a near-term breach multiplier and should be removed from circulation first.
👉 Read our full editorial: Active Directory credential risk is rising as exposed passwords spread