Identity Infrastructure Security

Q: How often should Active Directory security be reviewed?

A comprehensive assessment is useful as a starting point, but identity environments continuously change. New accounts, permissions, applications and administrative relationships can introduce new risks. Organisations should therefore combine periodic assessments with ongoing identity hygiene and monitoring.

Q: Is the Identity Infrastructure assessment a penetration test?

Not necessarily. The primary objective is to identify security weaknesses and attack paths without disrupting the environment. Where appropriate, attack techniques can be demonstrated or validated in a controlled manner, but the assessment is designed primarily around improving identity security.

Q: Do you assess Active Directory Certificate Services?

Certificate infrastructure can become a highly privileged part of the identity environment. Where Active Directory Certificate Services is present, certificate configuration and certificate-based attack paths can be included in the assessment.

Q: What about service accounts in Identity Infrastructure Security?

Service accounts are an important part of identity infrastructure security. They often have long-lived credentials, elevated permissions and dependencies that make them difficult to change. We identify high-risk service accounts and determine how their privileges and authentication can be improved.

Q: Do you only check Active Directory configuration?

No. Configuration analysis is only one part of the assessment. We also analyse privileges, attack paths, service accounts, authentication methods, hybrid identity relationships and architectural weaknesses.

Q: What is a shadow administrator?

A shadow administrator is an identity that effectively has administrative capabilities without necessarily being a member of an obvious administrative group. Delegated permissions, object ownership or indirect relationships can sometimes provide powerful privileges that are easily overlooked.

Q: What is an identity attack path?

An identity attack path is a chain of permissions, configurations or relationships that could allow an attacker to move from one compromised identity or system towards a more privileged target. Attack paths can involve group memberships, delegated permissions, service accounts, sessions, certificates or administrative roles.

Q: Does Identity Infrastructure Security also include Entra ID?

Yes, where Entra ID forms part of the identity infrastructure or creates a security relationship with the on-premises environment. The focus is primarily on identity architecture, privileged access, synchronisation and attack paths rather than general Microsoft 365 configuration.

Identity has become one of the primary attack paths into modern organizations.

Active Directory still forms the foundation of identity for many businesses.

But identities increasingly span on-premises Active Directory, cloud identity platforms, privileged accounts, service accounts and hybrid authentication components.

A weakness in any part of that identity infrastructure can provide attackers with a path towards sensitive systems, administrative privileges or complete control of the environment.

We help organizations identify and eliminate these attack paths by assessing, hardening and continuously improving their identity infrastructure.

Our approach looks beyond individual configuration settings. We examine how identities, privileges, authentication mechanisms and systems interact across the complete environment.

Active Directory has accumulated years of technical debt

Most Active Directory environments have evolved over many years.

Old groups, excessive privileges, legacy protocols, outdated configurations, unused accounts and historic exceptions gradually create security weaknesses that are difficult to see through normal administration.

Identify and remove hidden identity risks

We analyze the Active Directory environment for configuration weaknesses, excessive privileges, legacy configurations and attack paths.

Rather than producing a generic list of findings, we prioritize remediation based on actual security impact and provide a practical roadmap for improving the environment.

Attackers do not follow organizational boundaries

Organizations often manage Active Directory and cloud identity as separate environments.

Attackers do not. Synchronization, privileged accounts, administrative roles and authentication relationships can create paths between on-premises and cloud environments.

Secure the complete identity infrastructure

We analyze the relationship between on-premises Active Directory and cloud identity infrastructure. This includes privileged identities, synchronization components, authentication flows and trust relationships.

The objective is to eliminate unintended paths that could allow a compromise in one environment to spread into another.

Too many identities have hidden privileges

Administrative access is not always obvious.

Nested group memberships, delegated permissions, service accounts, application identities and historic ACLs can give accounts significantly more access than administrators realize. These so-called shadow privileges are attractive targets for attackers.

Understand who can really control what

We analyze effective privileges and attack paths across the identity environment.

This provides visibility into privileged groups, delegated permissions, service accounts and indirect administrative relationships. Unnecessary privileges can then be removed and sensitive identities better protected.

Legacy identity infrastructure remains difficult to replace

Older protocols, applications, service accounts and authentication mechanisms are often deeply integrated into business systems.

Removing them immediately may not be realistic.

Reduce risk while modernization continues

We identify legacy identity components and evaluate their security impact.

Where immediate replacement is not possible, we introduce compensating controls and hardening measures to reduce exposure. This allows organizations to improve identity security without waiting for a complete infrastructure redesign.

Results

What can you expect?

Clear visibility into identity attack paths

A full security and configuration assessment of Active Directory, showing how an attacker could move through your identity environment.

Control over privileged access

Analysis of privileged identities and delegated permissions, finding shadow administrators and excessive privileges.

Legacy and non-human identity risks addressed

A review of legacy authentication and protocols, plus an assessment of service accounts and other non-human identities.

A prioritised, practical remediation roadmap

Recommendations ranked by risk and aligned with their operational impact.

Secure hybrid and administrative structure

Analysis of how on-premises and cloud identities connect, and a review of administrative tiering and privileged access.

Ongoing support and identity hygiene

Hands-on help during remediation and hardening, with continuous identity hygiene where needed.

Reference case

Retiring a legacy identity component, without disruption

Sanoma relied on ADFS for secure sign-in, a federation service that bridges on-premises and cloud identity.

ACEN moved it to Microsoft Entra application by application, reducing on-premises infrastructure and maintenance and adding built-in security features.

How we handle Identity Infrastructure Security

Identity security requires more than scanning Active Directory for configuration settings.

We combine configuration analysis, attack-path analysis and architecture review to understand how an attacker could move through the identity environment.

Phase 1 Discover

We map the identity infrastructure.

This includes Active Directory domains and forests, cloud identity, synchronization components, privileged accounts, service accounts, authentication systems and other identity-related infrastructure.

Phase 2 Assess

We analyze identity configurations, access privileges and authentication systems to identify security weaknesses across your environment.

Our assessment covers privileged and service accounts, delegated permissions, credential exposure, authentication protocols, legacy configurations and hybrid identity relationships. By connecting individual weaknesses, we uncover realistic attack paths and identify how attackers could exploit them.

Phase 3 Prioritize

Not every finding represents the same level of risk.

We translate technical findings into a prioritized remediation roadmap based on exploitability, business impact and implementation effort.

Quick wins can be addressed immediately while larger architectural improvements are planned separately.

Phase 4 Harden & Maintain

We help implement the remediation roadmap and establish stronger identity security controls.

This can include privileged access redesign, administrative tiering, service account hardening, legacy protocol reduction, improved authentication controls and better identity monitoring.

Identity infrastructure continuously changes, so security should be reviewed regularly rather than treated as a one-time project.

Do you still have some questions?

Blog Article

SSH keys: hidden access nobody tracks

Unmanaged SSH keys stay valid until someone removes them, and attackers know it.

Find out why they’re a blind spot in your identity infrastructure and how to close it.

Contact

How secure is your identity infrastructure?

Whether you want to assess your existing Active Directory environment, understand privileged attack paths or improve security across a hybrid identity architecture, we can help.

First name

Last name

Phone

Company

I have a question about...

Your message

Yes, I would like to receive the ACEN newsletter

I agree that my data will be processed in accordance with the privacy policy *

“Good governance turns access from a one-time decision into a lifecycle that can be explained, reviewed and improved.”

Andres Van der SteenCybersecurity Consultant at ACEN

“The goal is not to block administrators or suppliers. It is to make privileged and remote access deliberate, temporary, limited to the task and traceable.”

Wouter LanduytSecurity Advisor and IGA Expert at ACEN

“I look back on the collaboration with ACEN with great satisfaction. They unburdened our IT department which, in turn, is now able to focus more on further developing the core of PrimUZ. ACEN offered security, ease of use with a greater array of login possibility and fluent scalability to our partner hospitals. All of this within budget. I find it impressive how ACEN quickly understood our needs, even in the challenging environment inherent to hospitals.”

Robin DemesmaekerManager ICT Infrastructure at UZ Brussel

We implemented the Imprivata OneSign solution within AZ Herentals, any user can now start authenticating with their badge at any workstation. The result is they can now focus on what matters, taking care of their patients.

Richard den HoudijkerIAM Security Specialist at ACEN

“The depth of applicable knowledge and the flexibility that Wouter and the entire ACEN team provided were truly outstanding. Their expertise proved invaluable, significantly simplifying our path and enabling us to successfully achieve the desired outcome.”

Dimitri GoosChief Information Security Officer at Sanoma

“Users should not have to choose between a simple login and a secure one. Every access decision should be deliberate, and strong authentication is about confidence, not more prompts.”

Jelle verrethIdentity Security Architect at ACEN

“If attackers control the identity foundation, every other control can be made to trust the wrong thing. We harden the core and make sure identity abuse is spotted and stopped fast.”

Robin GorrisIdentity & Access Management Architect at ACEN

FAQ

Everything you still wanted to know in one place

How often should Active Directory security be reviewed?

A comprehensive assessment is useful as a starting point, but identity environments continuously change.

New accounts, permissions, applications and administrative relationships can introduce new risks.

Organisations should therefore combine periodic assessments with ongoing identity hygiene and monitoring.

Is the Identity Infrastructure assessment a penetration test?

Not necessarily. The primary objective is to identify security weaknesses and attack paths without disrupting the environment.

Where appropriate, attack techniques can be demonstrated or validated in a controlled manner, but the assessment is designed primarily around improving identity security.

What about ADFS and other authentication infrastructure?

Authentication infrastructure such as federation services can also form part of the identity control plane.

Where relevant, these components can be included in the security assessment.

Do you assess Active Directory Certificate Services?

Certificate infrastructure can become a highly privileged part of the identity environment.

Where Active Directory Certificate Services is present, certificate configuration and certificate-based attack paths can be included in the assessment.

What about service accounts in Identity Infrastructure Security?

Service accounts are an important part of identity infrastructure security.

They often have long-lived credentials, elevated permissions and dependencies that make them difficult to change.

We identify high-risk service accounts and determine how their privileges and authentication can be improved.

Do you only check Active Directory configuration?

No. Configuration analysis is only one part of the assessment.

We also analyse privileges, attack paths, service accounts, authentication methods, hybrid identity relationships and architectural weaknesses.

What is a shadow administrator?

A shadow administrator is an identity that effectively has administrative capabilities without necessarily being a member of an obvious administrative group.

Delegated permissions, object ownership or indirect relationships can sometimes provide powerful privileges that are easily overlooked.

What is an identity attack path?

An identity attack path is a chain of permissions, configurations or relationships that could allow an attacker to move from one compromised identity or system towards a more privileged target.

Attack paths can involve group memberships, delegated permissions, service accounts, sessions, certificates or administrative roles.

Does Identity Infrastructure Security also include Entra ID?

Yes, where Entra ID forms part of the identity infrastructure or creates a security relationship with the on-premises environment.

The focus is primarily on identity architecture, privileged access, synchronisation and attack paths rather than general Microsoft 365 configuration.

Is Active Directory still relevant in a cloud-first environment?

Yes. Many organisations continue to rely on Active Directory for servers, applications, authentication and administrative processes even when most productivity workloads have moved to the cloud.

Hybrid identity also creates relationships between Active Directory and cloud identity environments that need to be secured.

What is Identity Infrastructure Security?

Identity Infrastructure Security focuses on protecting the systems and services responsible for authentication, authorisation and identity administration.

This typically includes Active Directory, cloud identity infrastructure, privileged identities, synchronisation components, authentication mechanisms and the relationships between them.

The identity strategy behind more than 12.500 student accounts at Odisee

Your fridge is on the network: what the supermarket cooling attacks teach every organisation

Why SoD should lead your choice of IGA platform

The identity strategy behind more than 12.500 student accounts at Odisee

Your fridge is on the network: what the supermarket cooling attacks teach every organisation

Why SoD should lead your choice of IGA platform

The identity strategy behind more than 12.500 student accounts at Odisee

Your fridge is on the network: what the supermarket cooling attacks teach every organisation

Why SoD should lead your choice of IGA platform

Identity Infrastructure Security

Active Directory has accumulated years of technical debt

Identify and remove hidden identity risks

Attackers do not follow organizational boundaries

Secure the complete identity infrastructure

Too many identities have hidden privileges

Understand who can really control what

Legacy identity infrastructure remains difficult to replace

Reduce risk while modernization continues

What can you expect?

Retiring a legacy identity component, without disruption

How we handle Identity Infrastructure Security

Do you still have some questions?

SSH keys: hidden access nobody tracks

How secure is your identity infrastructure?

Everything you still wanted to know in one place

How often should Active Directory security be reviewed?

Is the Identity Infrastructure assessment a penetration test?

What about ADFS and other authentication infrastructure?

Do you assess Active Directory Certificate Services?

What about service accounts in Identity Infrastructure Security?

Do you only check Active Directory configuration?

What is a shadow administrator?

What is an identity attack path?

Does Identity Infrastructure Security also include Entra ID?

Is Active Directory still relevant in a cloud-first environment?

What is Identity Infrastructure Security?

Explore our other Identity Security Services

Endpoint Security

Identity Threat Detection and Response (ITDR)

Certificate Lifecycle Management (CLM)

Secrets Management

Multi-Factor Authentication (MFA)

Workforce Access and Single Sign-On