🎯 SVC_BACKUP - Domain Admin with 620-day-old password
Critical
Service account with Domain Admin privileges, weak password (RC4-encrypted), no MFA.
Compromising this account would affect 2,147 identities across all platforms.
Finance department users with access to sensitive financial systems lack MFA protection.
Single credential compromise could lead to fraud or data exfiltration.
User accounts inactive for 90+ days still retain privileged access to production systems.
These are prime targets for credential stuffing and persistence attacks.
Dormant Period: 90-365 daysPrivilege Level: 64 with admin rightsAttack Vector: Credential stuffingRemediation: Disable or remove
🔗 Kerberos delegation enabled on 18 service accounts
High
Service accounts with unconstrained Kerberos delegation allow attackers to impersonate
any user to any service, enabling lateral movement and privilege escalation.
Affected Accounts: 18Attack Type: Kerberos delegation abuseTime to Exploit: <15 minutesRecommendation: Constrained delegation only
☁️ Azure AD/Entra mismatch: 234 identities out of sync
High
Identities with different privilege levels between on-premises AD and Azure AD/Entra.
Creates authorization bypass opportunities and compliance gaps.
Out of Sync: 234 identitiesImpact: Privilege escalation pathCompliance Risk: SOX, SOC 2Remediation: Sync or decouple
Compliance Framework Status
SOC 2 Type II
87%
Status: 13 controls remaining Priority: Audit logging retention (2555 days) Next Audit: March 2026
GDPR
92%
Status: 8 requirements remaining Priority: Right to be forgotten automation Data Retention: 30 days (configured)
ISO 27001
74%
Status: 26 controls remaining Priority: Access control documentation Next Review: January 2026
Recommendation: Prioritize remediation of 24 critical risks first (2 weeks, $45K investment).
This reduces overall risk score from 73 to 52 and lowers breach probability by 68%.