The 11-Hour Siege: Defending Identity in the Age of AI-Accelerated Adversaries

In the modern cybersecurity landscape, the "front door" of the enterprise is rarely a physical portal; it is a digital identity. As organizations increasingly migrate toward hybrid environments, the reliance on Microsoft Active Directory (AD) and Entra ID has turned these systems into the most critical pieces of infrastructure—and the most sought-after targets for malicious actors.

According to the Sophos 2025 Active Adversary Report, the window of opportunity for defenders is closing at an alarming rate. The median time between an attacker’s initial access and their first attempt to breach Active Directory has shrunk to a mere 11 hours. In an era where Artificial Intelligence (AI) is being weaponized to automate reconnaissance and compress attack timelines, this narrow window represents a crisis of speed. Strengthening the perimeter is no longer just about firewalls; it is about securing the fundamental identity systems that govern access to the entire enterprise.

---

The New Reality: AI-Driven Compression of Attack Timelines

The integration of AI into the adversary’s toolkit has fundamentally altered the economics of cybercrime. While AI has not yet birthed entirely "new" classes of attacks, it has achieved something perhaps more dangerous: it has optimized the execution of existing ones.

As outlined in the Sophos AI Security 2026 Report, attackers are using AI to automate the discovery of vulnerabilities, generate tailored malicious tooling, and execute lateral movement with unprecedented precision. When an adversary gains a foothold, they no longer need to spend days manually mapping a network. AI-driven scripts can identify high-value targets, escalate privileges, and extract data in hours rather than weeks.

For security operations centers (SOCs), this means the traditional reactive posture is obsolete. If the time to reach a domain controller is 11 hours, a security team relying on manual logs and legacy response times will consistently arrive at the scene after the breach has reached the point of no return.

---

Categorizing the Threat: The CISA 17

The Cybersecurity and Infrastructure Security Agency (CISA) has identified 17 specific techniques that adversaries frequently use to compromise Active Directory. To make these actionable for security teams, we can categorize them into four operational pillars. This framework allows defenders to move beyond chasing individual alerts and start seeing the "attack sequence" as a whole.

1. Credential Access: Fortifying the First Line

Credential-access techniques—such as password spraying, Kerberoasting, and AS-REP Roasting—transform standard identity functions into weapons. These methods allow attackers to harvest legitimate credentials, effectively "becoming" a trusted user.

• The Anatomy of the Breach: In a March 2026 incident involving Interlock ransomware, attackers utilized legitimate protocols to query Active Directory for domain-group information and service principal names. By appearing as a valid user, they moved undetected until the final stages of the attack.
• The Defense: The priority here is the implementation of multi-factor authentication (MFA) that is resistant to phishing, alongside the removal of legacy authentication protocols. Managed Detection and Response (MDR) services play a pivotal role here by correlating authentication patterns with endpoint telemetry, allowing analysts to distinguish between a user logging in from home and an automated "spray" attempt.

2. Privilege Escalation: Protecting the Path to Tier 0

Once an attacker holds a valid credential, their next goal is "Tier 0" access—the keys to the kingdom. Techniques like DCSync, dumping ntds.dit, and abusing MachineAccountQuota allow attackers to escalate from a standard user to a Domain Administrator.

• Operational Insight: Sophos MDR observed an incident where an attacker leveraged an unpatched FortiGate VPN to gain initial access, then immediately pivoted to the domain controller. By using AV-killer tools and performing aggressive enumeration, the adversary attempted to establish persistence.
• The Strategy: Organizations must treat privileged identity changes as "high-fidelity" alerts. Monitoring for unauthorized computer account creation or unexpected replication requests is essential. The objective is to identify the "who, what, and where" of every administrative action, ensuring that privileged activity is always backed by an explicit business need.

3. Certificates and Authentication: Securing the Issuers of Trust

Modern identity relies on trust infrastructure, including Certificate Authorities (CA) and AD Certificate Services (AD CS). If an attacker compromises these systems, they can forge "Golden Certificates" or "Golden Tickets," granting them permanent, authenticated access that bypasses standard password resets.

• The Hidden Threat: Research into the STAC4749 campaign revealed that attackers are embedding CA certificates into their command-and-control (C2) communications to bypass security filters. This "trust abuse" happens beneath the level of standard login monitoring.
• Defensive Imperative: Defenders must monitor not only the authentication events themselves but the systems that issue those tokens. This requires centralized logging of certificate template modifications and CA security settings, integrated into a Next-Gen SIEM that can visualize the entire trust chain.

4. Persistence: The Illusion of Recovery

Perhaps the most daunting challenge is ensuring an attacker is truly purged from the system. Techniques like Golden SAML, Entra Connect compromise, and SID History manipulation allow adversaries to maintain access even after a password reset.

• The Response Principle: A compromised identity is rarely just one compromised password. When an incident occurs, responders must evaluate the entire hybrid environment—linking on-premises AD activity with cloud-based Entra ID signals.
• Actionable Intelligence: As seen in a 2025 incident at Sophos, where a phishing attack successfully bypassed MFA, the recovery process required a multi-layered response—revoking sessions, blocking sign-ins, and auditing every connected application. Simply changing a password is often insufficient if the attacker has already established a secondary path via a malicious inbox rule or an orphaned synchronization token.

---

Implications for the Modern Security Leader

The data is clear: identity is the new perimeter. The 11-hour window represents the "new normal" for incident response. Security leaders must shift their focus from perimeter defense to identity-centric resilience.

The Role of Managed Detection and Response (MDR)

In this high-velocity environment, human expertise alone is not enough, nor is automated tooling alone. The future of security is an "agent-enabled" model. Sophos MDR provides this by connecting disparate signals:

1. Correlation: Linking endpoint behavior, identity logins, and directory modifications.
2. Context: Distinguishing between a routine IT task and a malicious lateral movement attempt.
3. Response: Executing pre-authorized actions, such as revoking compromised tokens or isolating infected endpoints, to halt an attack before it reaches the domain controller.

The "Fundamentals" Mandate

While AI continues to dominate headlines, the most effective defense remains the "non-negotiable" fundamentals. These include:

• Zero-Trust Principles: Verify every request, regardless of whether it originates from inside or outside the network.
• Hardened Identity Posture: Regularly auditing AD for risky permissions, dormant accounts, and excessive privileges.
• Telemetry Integrity: Ensuring that security tools have visibility into the full stack—from the endpoint to the cloud identity provider.

Conclusion: Closing the Door Before the Clock Runs Out

The rise of AI-powered threats has not changed the fundamental nature of cyber warfare; it has simply accelerated the timeline. Attackers have always wanted to reach the domain controller; they are now just getting there faster.

For the modern organization, the mission is straightforward: harden the identity systems, maintain visibility across the entire hybrid environment, and ensure that the response mechanism is ready to act in minutes, not hours. The 11-hour window is a warning, not a death sentence. By focusing on identity fundamentals and leveraging the speed of AI-augmented MDR, defenders can lock the front door and maintain control over their infrastructure, even in the face of an increasingly sophisticated adversary.

As the digital landscape evolves, the organizations that survive will be those that realize the strength of their security is not defined by the speed of their detection engine alone, but by the security of the identity systems that define their access to the world.