Identity compromise now drives 80% of cyber intrusions—making it the primary attack vector in modern cybersecurity. When Active Directory fails, entire business operations halt: employees can't authenticate, applications fail, and critical services go dark. Yet traditional approaches create dangerous gaps: monitoring that relies on logs attackers can clear, recovery processes requiring 22+ error-prone manual steps, and visibility blind spots across non-human identities like service accounts and OAuth tokens.
In this webcast, SANS Analyst Matt Bromiley shares findings from his comprehensive evaluation of Rubrik Identity Resilience—a platform combining proactive identity protection and rapid recovery across Active Directory, Entra ID, and Okta. Matt will examine how modern identity resilience solutions address critical gaps that legacy approaches miss, including tamper-resistant monitoring that attackers can't disable and surgical rollback capabilities that preserve business operations while reverting malicious changes.
What You Will Learn
- Why identity has become "ground zero" for modern attacks—and how 90% of attacks on critical infrastructure now begin with identity compromise rather than network perimeter breaches
- The multi-IdP challenge organizations face today: why protecting only Active Directory leaves Entra ID and Okta-based SaaS applications exposed, and what unified recovery across multiple identity providers looks like in practice
- How surgical rollback changes the game: selectively reverting attacker modifications (GPO changes, group memberships, privilege escalations) while preserving legitimate business changes made during the compromise
- The tamper-resistant monitoring advantage: why traditional tools that depend on Windows event logs fail when attackers clear those logs, and how independent monitoring with immutable event data provides more reliable threat detection
- Reducing recovery from days to hours: how modern orchestration transforms the 22-step AD forest recovery process into streamlined workflows with clean room testing before production deployment
- The non-human identity blind spot: discovering and securing the service accounts, API keys, and OAuth tokens that outnumber human identities and drive increasingly sophisticated supply chain attacks
