Notifications
Clear all
Topic starter
25/06/2026 12:49 am
TL;DR: Identity-related ransomware turns Active Directory into an operational choke point because standard backup and restore can reintroduce malware, hidden backdoors, and persistent compromise, according to Semperis. Recovery now depends on malware-free backups, clean restoration, and identity-specific forensics, making AD resilience a governance issue rather than a narrow infrastructure task.
NHIMG editorial — based on content published by Semperis: Active Directory resilience and the Semperis-Cohesity partnership
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems, and organisations failing to scope AI access properly are 4.5x more likely to experience a security incident.
- 17 minutes, redentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What fails when Active Directory is restored after ransomware without identity validation?
A: The directory can come back online while the attacker’s persistence also returns.
Q: Why do identity-related ransomware attacks make AD recovery so difficult?
A: Because AD is the enterprise trust fabric, not just another workload.
Q: How should teams decide whether an AD backup is safe to use?
A: They should verify that the backup is malware-free, that the directory state matches expected trust relationships, and that no attacker-created principals or persistence mechanisms are present.
Practitioner guidance
- Validate AD backup provenance before restore Require malware scanning, integrity checks, and recovery-point validation for directory backups before they are eligible for production use.
- Build a clean-room identity restoration runbook Separate directory recovery from routine infrastructure recovery and define a controlled process for rebuilding trust relationships, privileged groups, and replication state in a verified environment.
- Add identity forensics to incident response Track which accounts, group memberships, trusts, and delegation paths changed during the attack so responders can remove persistence before reconnecting production systems.
What's in the full article
Semperis' full post covers the operational detail this analysis intentionally leaves for the source:
- The partnership workflow for combining identity recovery capabilities with immutable backup handling in hybrid AD environments.
- The specific recovery and forensics capabilities discussed for verifying directory integrity before production restore.
- The management discussion that frames why identity resilience is now part of business continuity planning.
- The direct explanation of how the joint offering is positioned around real-world incident response needs.
👉 Read Semperis' analysis of Active Directory resilience for identity-related ransomware →
Active Directory recovery after ransomware: what IAM teams must fix?
Explore further
25/06/2026 9:51 am
Active Directory recovery is now an identity integrity problem, not a backup problem. The article correctly centers malware-free restore and post-breach validation because directory recovery can fail even when the backup itself is intact. Hidden backdoors, persistence in privileged groups, and trust-path corruption mean the environment must be proven clean before it is trusted again. Practitioners should treat AD restoration as a governed identity state transition, not an infrastructure reset.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to The 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who is accountable for proving identity integrity after a directory breach?
A: Accountability sits across IAM, PAM, incident response, and recovery owners because all four functions influence whether the restored directory is trustworthy. The organisation must be able to show what changed, who had elevated access, and how hidden persistence was removed before normal operations resume.
👉 Read our full editorial: Active Directory resilience for ransomware needs identity-specific recovery
