Identity and Secure Access
Attackers prefer to log in rather than break in – and once inside, they move through the network using compromised accounts. We protect human accounts, service accounts, and AI agents even where classic MFA doesn’t reach: in Active Directory, administrative tools, and legacy systems. We provide access to applications without opening up the entire network and detect accounts compromised by phishing. On the Silverfort platform, with YubiKey keys, Zscaler access, and Proofpoint account protection.
4–5min
that’s how long it took AI agents to complete the full attack chain up to domain takeover – in the Silverfort lab. Several agents operated in parallel, and the entire process cost the equivalent of $12, with time costing approximately $4.1
5%
of organizations are confident they have a complete inventory of non-human identities – service accounts, tokens, and AI agents.2
64%
of user accounts in Active Directory regularly log in using the NTLM protocol, which does not support MFA.3
82%
of detections in 2025 did not involve malware. Attackers operate on valid accounts and legitimate tools.4
$4.99 million
average global cost of a data breach in 2026 – the highest in the report’s history.5
What stopped the agents: Silverfort repeated the same attack with two controls at the authentication point. The service account could only connect to systems it truly needed, and the domain administrator had to pass MFA on all protocols. The result changed from domain takeover to “objective not achieved” – agents looked for workarounds, but every path led through an identity they could not use. The vendor notes that the lab is cleaner than production, so these are patterns, not benchmarks.1
Scenarios from Silverfort, Proofpoint, and Zscaler research and incident analyses. In none of them does the attacker break security – they log in with someone else’s identity. For each: what our technology does at that point.
The attacker checks passwords from leaks or one popular password across hundreds of accounts. 43% of identity security practitioners identify these two methods as the most common attacks in their company.2
Silverfort: assesses the risk of each authentication – including in Active Directory – and for suspicious logins, it demands MFA or blocks access.
An intermediary site (AiTM), a hijacked session, or a malicious OAuth application grants access to a cloud account despite MFA. Then the attacker adds their own MFA method, sets mailbox rules to hide traces, and sends phishing emails from the legitimate account. Proofpoint data shows 67% of organizations experienced at least one successful cloud account takeover within a year, and in 59% of these, the compromised accounts had MFA enabled.6
Proofpoint: detects compromised accounts in Microsoft 365, Google Workspace, and Okta and remediates them automatically – revoking MFA changes, deleting mailbox rules and malicious applications, and invalidating sessions.
Groups like Scattered Spider impersonate employees or IT: they trick users into password resets and MFA approvals, take over phone numbers (SIM swapping), and bombard people with push notifications until someone approves. They then operate in AD – on NTLM, LDAP, and SMB protocols, which lack MFA, and via PowerShell, PsExec, and RDP.7
Silverfort: recommends strengthening the helpdesk but not relying on it. FIDO2 keys for privileged accounts, MFA on all AD protocols, and segmentation that separates privileged accounts from regular environments.
VPN exposes a gateway to the internet, and once logged in, it grants access to the entire network. A device vulnerability or stolen password is all it takes. A Zscaler study found 56% of organizations reported a breach using VPN in the last year, and the number of known VPN vulnerabilities has increased by 82.5% since 2020.8
Zscaler: connects the user to a specific application, not the network, and does not expose applications to the internet. Risk detected by Silverfort can immediately tighten or block access in Zscaler.9
With a compromised account, an attacker moves between servers via PsExec, PowerShell, and RDP – using Kerberos and NTLM protocols, which do not support MFA. 64% of accounts in AD still log in via NTLM, and Silverfort researchers showed that even outdated NTLMv1 can operate despite a group policy intended to disable it.3
Silverfort: MFA and access rules on every authentication in AD – including from the command line and on older protocols. Risky protocols, such as NTLM, can be blocked.
Service accounts make up 31% of user accounts in AD.10 They have broad permissions and static passwords, and no one logs in with them manually – regular MFA won’t cover them. Nearly 80% of organizations don’t see what these accounts are doing.11
Silverfort: detects service accounts, learns their usual paths, and uses a “virtual fence” to block deviations – e.g., connection from a new server or to a new target.
67% of companies synchronize most user passwords from on-prem AD to the cloud10, and 56% unknowingly synchronize service accounts to SaaS directories.12 A compromised AD account thus also opens up the cloud. Additionally, one misconfiguration of an AD account creates an average of 109 hidden administrators.10
Silverfort: protects access simultaneously in AD and with cloud identity providers, and the ISPM module identifies configuration weaknesses for remediation.
AI agents conduct multiple attack stages simultaneously and do not give up. In the Silverfort lab, they took over a domain in 4–5 minutes.1 In another test, in an AWS cluster with misconfigurations, an agent with a single container permission stole a neighboring service’s token and read a secret after approximately 6 minutes.13 Corporate AI agents, in turn, are new identities with their own permissions.
Silverfort: treats AI agents as identities – detects them, assigns an owner to each, and verifies their actions before execution.14
MFA in an identity provider, such as Entra ID or Okta, protects logins to web applications and SaaS. Authentications within Active Directory inside the network bypass it.
These are precisely the paths through which lateral movement and ransomware encryption occur.
Silverfort
Silverfort connects to Active Directory and cloud identity providers. It evaluates every authentication in real-time and decides: allow, require MFA, or block. According to the vendor, it requires no agents, proxies, or changes to application code.
MFA for legacy applications, command-line tools, RDP and SSH, file shares, IT and OT infrastructure – on Kerberos, NTLM, and LDAP protocols.
Automatic detection of service accounts in AD and machine identities in the cloud. Behavior profiling and a “virtual fence” that blocks deviations.
Classification of privileged accounts based on real activity, just-in-time access, and reduction of standing privileges.
Identity-based “deny” rules: access segmentation in AD, blocking of risky protocols like NTLM, freeze mode during a ransomware attack.
ITDR detects identity attacks and responds before access is granted. ISPM identifies weak spots in identity configuration for remediation.
Detection of AI agents, owner assignment, and control of their actions before execution – including in Microsoft Copilot Studio, Google Cloud, and via the MCP gateway.
According to Silverfort: over 1000 organizations, 10 billion authentications daily, initial protection in less than 24 hours.14
Zscaler
65% of organizations plan to replace VPN within a year.8
Proofpoint
83% of organizations with a compromised account had suspicious mailbox activity – reading correspondence before the next phishing attempt.6
A FIDO2 hardware key binds login to the address of the genuine service. An intermediary site cannot intercept the session, phone numbers cannot be taken over, and users cannot be bombarded with notifications. Silverfort recommends FIDO2 keys or passkeys for privileged accounts and critical systems.7
Regular MFA is not enough: Proofpoint data shows that in 59% of organizations with compromised cloud accounts, those accounts had MFA.6 And keys are still rare – in a 2026 Yubico study, 43% of IT and security professionals still log in at work with a password, and 44% of surveyed companies experienced an AI-driven attack in the last year.17
We recommend keys primarily to administrators, helpdesk staff, and individuals with access to sensitive data – where the compromise of a single account opens up the entire network.
Article 21(2)(j) of the directive lists multi-factor or continuous authentication among risk management measures – “where appropriate”.20
The amendment to Poland’s National Cybersecurity System Act (KSC Act) implementing NIS2 comes into force on April 3, 2026. Essential and important entities have until April 3, 2027, to implement obligations, and executives are also responsible for cybersecurity.21
Article 9 of the regulation requires financial entities to implement strong authentication mechanisms and access rights management, among other things.20
Regulations do not specify products. We help meet the MFA requirement where it’s most difficult – in Active Directory, administrative tools, and technical accounts.
SafeWave has been operating since 1998 as a vendor-agnostic integrator. We conduct implementations in stages so that protection does not halt company operations.
We map accounts, protocols, and access paths in Active Directory, in the cloud, and in remote access. We identify service accounts with excessive privileges and areas without MFA.
Silverfort learns account behavior without blocking work. You see real risks based on data from your own environment.
First, privileged accounts and lateral movement paths, then service accounts and users. YubiKey keys for administrators and helpdesk, access via Zscaler instead of VPN, cloud account protection with Proofpoint.
Policy tuning, access reviews, and support in English and Polish.
Start with an identity exposure assessment. We will show you service accounts with excessive privileges, lateral movement paths, and areas without MFA in your environment.