Notifications
Clear all
Topic starter
02/08/2026 12:07 pm
TL;DR: Active Directory Tripwires shift deception from broad decoys to identity-focused lures that trigger when attackers probe real escalation paths, with the article citing 90% enterprise AD reliance, nearly 50% attack incidence, and 11-hour escalation windows. The governance lesson is that detection value now depends on placement intelligence, not decoy volume, according to Horizons.ai.
NHIMG editorial — based on content published by Horizons.ai: From Honeypots to Active Directory Tripwires
By the numbers:
- Nearly 90% of organizations worldwide rely on Active Directory to manage authentication and authorization.
- Research shows that nearly half of organizations have experienced AD attacks in the past two years, and more than 40% of those attacks resulted in successful compromise.
- Attackers can escalate privileges into AD in as little as 11 hours following initial compromise.
Questions worth separating out
Q: How should security teams place deception controls in Active Directory?
A: They should place deception on identity paths attackers are most likely to inspect for privilege escalation, not in random locations that generate weak signal.
Q: Why do deception tools fail when they are not tied to identity attack paths?
A: They fail because placement determines whether the decoy intersects with real attacker behaviour.
Q: How do teams know whether a tripwire is actually working?
A: A tripwire is working when it triggers on the intended abuse pattern, carries enough context for analysts to understand why it fired, and supports a clear response path.
Practitioner guidance
- Map your highest-risk AD attack paths first Identify the identity behaviours most likely to precede privilege escalation, including ticket requests, directory enumeration, and metadata scraping.
- Require context on every deception alert Make sure each alert includes what the decoy represented, where it was placed, and which weakness it was meant to expose.
- Test tripwires against realistic attack simulations Validate that the decoy triggers when expected by simulating the identity abuse pattern it was built for.
What's in the full article
Horizons.ai's full whitepaper covers the operational detail this post intentionally leaves for the source:
- The specific NodeZero Tripwire deployment model and how the agent is configured in Active Directory
- The PowerShell setup steps, domain policy template application, and validation workflow described in the source
- The full attack-technique mapping for kerberoasting, AS-REP roasting, and metadata scraping detection
- The SOC integration and end-to-end testing examples used to prove alert fidelity in production
👉 Read Horizons.ai's whitepaper on Active Directory tripwires and deception-driven detection →
Active Directory tripwires and identity deception: are controls keeping up?
Explore further
02/08/2026 1:12 pm
Identity deception only becomes governance-relevant when it maps to real attacker paths. Random decoys create comfort, not control. What matters is whether the lure is placed on the same identity surfaces attackers already probe for escalation, ticket abuse, or directory scraping, because that is where proof of attack becomes operationally useful.
A few things that frame the scale:
- From our research: 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- From our research: Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: What should teams do after a deception alert fires in Active Directory?
A: They should treat it as evidence of malicious identity probing, not as a low-priority notification. The immediate task is to validate the attack path represented by the decoy, check for adjacent identity abuse, and use the alert context to guide containment before the attacker expands access further.
👉 Read our full editorial: Active Directory tripwires show how deception can surface attacker intent
