Active Directory

Okta has agreed to acquire Permiso Security, a cloud-based company specializing in identity threat detection and response. The deal aims to integrate real-time threat detection with identity security posture management, enhancing alert accuracy for security teams. Permiso’s tools will expand Okta’s visibility beyond its current systems, addressing AI-related security risks and supply-chain attacks in AI agents.

The article highlights a shift in cybersecurity focus from advanced AI models to 'harness' tools that control and adapt these models for enterprise use. Cato Networks' research demonstrates how pairing OpenAI models with a custom harness enabled rapid, autonomous cyberattacks in simulated scenarios, emphasizing the harness's role in enhancing AI capabilities for both offensive and defensive purposes.

A UK school's network was found to have severe security vulnerabilities, including unauthenticated access to Active Directory domain controller tools and cleartext admin passwords stored in description fields. A 17-year-old student discovered these flaws, gaining access to sensitive data, staff/student information, and systems like Google Workspace and LanSchool, but chose not to exploit them.

A company stored service account passwords in Active Directory description fields, leading to a ransomware attack after hackers accessed these credentials via phishing and the Sliver tool. The breach resulted in 2000+ users being affected and the company being offline for months.

A threat actor is using an AI-built ransomware toolkit that automates Active Directory discovery and helps evade endpoint detection and response (EDR) solutions.

Specops Software highlights methods to enforce strong Active Directory passwords through passphrases, breached password protection, and self-service resets, ensuring security without compromising user experience.

Resetting a password doesn't always remove attackers from Active Directory, as cached credentials and Kerberos tickets can keep them authenticated after a reset. This is explained by Specops Software. Attackers can remain in the system even after a password change.

Researchers in February 2026 identified a significant shift in cyber threats: threat actors now use custom AI setups to automate attacks within the kill chain, including autonomous agents that map Active Directory and steal Domain Admin credentials rapidly. Defensive workflows struggle to keep pace with these advanced AI-driven tactics.