Topic starter
25/06/2026 3:19 pm
TL;DR: Organisations still struggle to identify and remediate vulnerabilities across Active Directory, Entra ID, and Okta, with an average score of 61 out of 100, 11 points below 2023 and midsized environments faring worst, according to Semperis’ 2025 Purple Knight Report. Low visibility and uneven remediation remain the central problem, not lack of tooling.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “2025 Purple Knight Report Reveals Persistent Security Gaps in Hybrid Active Directory and Entra ID Environments”.
By the numbers:
- The average score of 61 out of 100 is 11 points lower than the average score of 72 in the 2023 report.
- Organisations applying Purple Knight’s remediation guidance reported an average improvement of 21 points, and as high as 61 points.
- Organizations with between 2,001 and 5,000 employees averaged a score of 52, the worst overall.
Key questions
Q: Why do hybrid identity assessments keep missing important vulnerabilities?
A: They miss them when teams treat Active Directory, Entra ID and Okta as separate silos instead of one governed identity surface.
Q: What should IAM teams do first when hybrid identity scores are low?
A: Start by building a single remediation backlog that assigns every finding an owner, a due date, and a retest step.
Q: What signals show that hybrid identity remediation is actually working?
A: The strongest signal is sustained improvement across multiple assessment cycles, not a one-time score jump.
Practitioner guidance
- Map hybrid identity to one remediation queue Create a single backlog for Active Directory, Entra ID and Okta findings so ownership does not fragment across platforms and teams.
- Assign closure owners to each assessment category Give infrastructure, account security, Kerberos, Group Policy, Entra ID and Okta findings explicit remediation owners and target dates.
- Use score deltas to prioritise high-friction gaps Focus first on weaknesses that keep recurring across assessments, because those indicate process or ownership failures rather than isolated technical defects.
Bottom line: Hybrid identity risk persists when assessment and remediation are not governed as one process across Active Directory, Entra ID and Okta.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:46 pm
Hybrid identity assessment gaps are a governance failure, not a tool failure. Organisations already have ways to scan Active Directory, Entra ID and Okta, but the report shows that visibility alone does not produce closure. The discipline gap is in turning findings into accountable remediation across multiple identity planes. Practitioners should treat scorecards as governance inputs, not as proof of control.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What is the difference between hybrid identity assessment and hybrid identity remediation?
A: Assessment finds exposure, while remediation removes it. In hybrid identity environments, the distinction matters because repeated scanning without closure only measures technical debt, whereas remediation changes the actual attack surface across directories and identity providers.
👉 Read our full editorial: Hybrid identity security scores expose persistent assessment gaps