Topic starter
25/06/2026 3:19 pm
TL;DR: Semperis' analysis of hybrid identity environments finds organisations still average 61 out of 100 in 2025 Purple Knight reporting, 11 points below 2023. Teams need a governed remediation process, because assessment alone does not close exposure across Active Directory, Entra ID and Okta.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “2025 Purple Knight Report Reveals Persistent Security Gaps in Hybrid Active Directory and Entra ID Environments”.
By the numbers:
- The average score of 61 out of 100 is 11 points lower than the average score of 72 in the 2023 report.
- Organisations applying Purple Knight’s remediation guidance reported an average improvement of 21 points, and as high as 61 points.
- Organizations with between 2,001 and 5,000 employees averaged a score of 52, the worst overall.
Key questions
Q: What should IAM teams do first when hybrid identity scores are low?
A: Start by building a single remediation backlog that assigns every finding an owner, a due date, and a retest step.
Q: What signals show that hybrid identity remediation is actually working?
A: The strongest signal is sustained improvement across multiple assessment cycles, not a one-time score jump.
Q: Why do hybrid identity assessments keep missing important vulnerabilities?
A: They miss them when teams treat Active Directory, Entra ID and Okta as separate silos instead of one governed identity surface.
Practitioner guidance
- Map hybrid identity to one remediation queue Create a single backlog for Active Directory, Entra ID and Okta findings so ownership does not fragment across platforms and teams.
- Assign closure owners to each assessment category Give infrastructure, account security, Kerberos, Group Policy, Entra ID and Okta findings explicit remediation owners and target dates.
- Use score deltas to prioritise high-friction gaps Focus first on weaknesses that keep recurring across assessments, because those indicate process or ownership failures rather than isolated technical defects.
Bottom line: Hybrid identity risk persists when assessment and remediation are not governed as one process across Active Directory, Entra ID and Okta.
Glossary terms: Hybrid Identity, Assessment Score, Remediation Guidance, Identity Exposure Path
What's in the full report
Semperis' full report covers the operational detail this post intentionally leaves for the source:
- Category-by-category Purple Knight scoring across Active Directory, Entra ID and Okta
- Industry and company-size breakdowns that show where hybrid identity gaps are worst
- Practitioner guidance on how Purple Knight users improved scores after remediation
- The full list of 185+ security indicators of exposure or compromise used in the scan
👉 Read Semperis' report on hybrid identity score gaps and remediation outcomes →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/06/2026 4:46 pm
Hybrid identity assessment gaps are a governance failure, not a tool failure. Organisations already have ways to scan Active Directory, Entra ID and Okta, but the report shows that visibility alone does not produce closure. The discipline gap is in turning findings into accountable remediation across multiple identity planes. Practitioners should treat scorecards as governance inputs, not as proof of control.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What is the difference between hybrid identity assessment and hybrid identity remediation?
A: Assessment finds exposure, while remediation removes it. In hybrid identity environments, the distinction matters because repeated scanning without closure only measures technical debt, whereas remediation changes the actual attack surface across directories and identity providers.
👉 Read our full editorial: Hybrid identity security scores expose persistent assessment gaps