How to Map and Fix Identity Attack Paths in Active Directory | SpecterOps
Source: YouTube · Cloud Security Podcast · published Sep 9, 2026 · 16:58
Identity security has shifted from "who has admin rights" to "who can reach a critical outcome," as individually harmless permissions combine into exploitable attack paths 3:14.
Key Takeaways:
• Environments often contain thousands of attack paths; red flags include poor identity visibility, excess domain admins, risky service accounts, deep group nesting, and stale accounts 4:06
• Missing basics stem from prioritization and accountability problems—knowing what to fix first matters more than perfect security 6:35
• Fix attack paths in peacetime ("a silent Tuesday afternoon") rather than mid-incident while fighting to take back your identity 7:47
• AI agents multiply non-human identities; their need for tools and access creates growing new attack paths 10:02
• The miasma supply chain incident was fundamentally a trust policy design failure—CI/CD compromise and trust abuse that SLSA and OIDC failed to catch 11:45
• BloodHound, used by testers and attackers alike, maps all paths across identity schemas, showing how small decisions become wartime problems 13:39
Organizations should self-assess whether they can visualize paths to critical assets, track non-human identities, and reduce identity sprawl before attackers exploit the gaps.
Sources:
- 3:14 Shift to who can reach critical outcomes
- 4:06 Thousands of attack paths; identity red flags
- 6:35 Prioritization and accountability challenges
- 7:47 Peacetime vs. wartime remediation
- 10:02 AI agents as emerging attack paths
- 11:45 Miasma as a trust policy design failure
- 13:39 BloodHound's attack path analysis evolution
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
There are thousands of attack paths usually in customer environments. >> I do single sign-on. I do MFA. My identity is done. Is that the right way to look at identity today in an AI world? >> A user may not be a domain admin, but they may be able to reset another account, modify a group, trigger a deployment, and individually those permissions can look harmless in a graph, they become an attack path. >> We have to talk about AI because with all those agents spreading, we have all those non-human identities, and they get more and more and more. These are the potential new attack paths in the future and already today. >> This is a supply chain incident, and it is being presented as a malware problem, but it is fundamentally a trust policy design issue. Here, a tool that is being used by pen …