Notifications
Clear all
Topic starter
06/06/2026 1:49 am
TL;DR: Identity resilience means an identity system can be compromised or wiped out and still be recovered in a trustworthy way, with Active Directory demanding precise, ordered restoration and proof that recovery meets the business RTO, according to Semperis. Backup alone is not resilience; practitioners need to prove recovery under realistic failure conditions.
NHIMG editorial — based on content published by Semperis: What does identity resilience actually mean?
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- Only 5.7% of organisations have full visibility into their service accounts.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: How should teams prove identity resilience in Active Directory environments?
A: They should prove that identity can be restored into a trustworthy state, not just that data can be copied back.
Q: Why do identity systems need a different recovery approach than normal servers?
A: Identity systems are authoritative for authentication and authorisation, so a bad restore can recreate compromise instead of removing it.
Q: What breaks when recovery is measured only by backup success?
A: What breaks is the assumption that a successful restore equals a usable identity service.
Practitioner guidance
- Test identity recovery as a production event Run proof-of-concept recovery against a realistic Active Directory environment, including critical domain structure, dependencies, and the capacity needed for minimum viable business operations.
- Define the RTO around business service restoration Set recovery targets based on when core applications can authenticate and function again, not when the first domain controller is online.
- Separate host compromise from directory compromise Document different recovery paths for compromised Windows hosts and for malicious changes inside the directory database, then validate both paths independently.
What's in the full article
Semperis' full article covers the operational detail this post intentionally leaves for the source:
- Practical requirements for proving Active Directory recovery against a realistic production environment.
- The difference between a directory restore that starts and one that actually restores business capability.
- How to assess whether a resilience platform can handle compromised AD and post-restore persistence hunting.
- Checklist-style guidance for validating recovery time objectives before a real cyber crisis.
👉 Read Semperis' analysis of identity resilience and Active Directory recovery →
Identity resilience and AD recovery: are your controls ready?
Explore further
06/06/2026 3:10 am
Identity resilience is really trust restoration, not backup restoration. The article is right to separate copied data from a recoverable identity plane, because identity systems are the authoritative source for access. If the restored directory cannot be trusted, the enterprise is still down even when data exists. Practitioners should treat this as a resilience design problem, not a storage problem.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who should own identity recovery accountability when the directory is compromised?
A: The identity team should own the recovery design, with infrastructure, security, and application stakeholders tied to the same business recovery target. A directory compromise is not just a systems issue, because it affects authentication, authorisation, and operational continuity at once. Accountability has to sit with the function that governs identity trust.
👉 Read our full editorial: Identity resilience means proving recovery, not just backup
