IS YOUR ACTIVE DIRECTORY STILL PROTECTING YOU?

Active Directory (AD) has run quietly in the background of enterprise IT for 25 years — the kind of system nobody thinks about until something goes wrong. Lately, more things are going wrong.

The Verizon 2025 Data Breach Investigation Report found that 88% of breaches now involve compromised credentials, with attackers increasingly using AD authentication itself — not malware — to get in and stay hidden. That's the uncomfortable part: once someone has valid credentials, AD usually doesn't stop them. It hands them the keys. [Source: Morphisec]

Malaysia is very much in the middle of this. Nearly 35.9% of Malaysian organizations reported at least one cybersecurity incident between January 2024 and December 2025, with credential theft behind a quarter of those attacks, and average losses now running RM3.2 million per breach. More than 30 confirmed ransomware incidents hit Malaysian organizations in just the first half of 2026 alone — one of the highest counts in Southeast Asia. Manufacturing, healthcare, and logistics firms have taken the brunt of it, often facing weeks of disruption. [Source: Free Malaysia Today; Simply Data 2026 H1 Ransomware Report; Simply Data 2026 Threat Landscape]

A lot of this traces back to Group Policy — the mechanism most companies use to push settings across every machine on the network. A single Group Policy Object can control thousands of settings at once, so one small mistake, like giving the wrong account editing rights, can quietly turn into a domain-wide backdoor. Attackers know this. Group Policy abuse has become a go-to move in ransomware playbooks worldwide, not because it's exotic, but because it's trusted infrastructure nobody's watching closely enough. [Source: Lepide]

And here's the part that makes this urgent rather than theoretical: the tool many companies relied on to catch exactly this kind of change — Microsoft's AGPM reached its end of life in April 2026. No more updates, no replacement from Microsoft. If you're still running AD without something actively governing your Group Policy changes, that gap isn't hypothetical anymore. It's just open.

None of this means tearing out Active Directory. It means putting real governance back around it — version control, approvals, a way to roll back a bad change before it becomes a headline.