Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW

Directory Security Through Privilege Tiering

Netwrix
07/15/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


The answer lies in tiering, separating privileges to minimize risk and prevent catastrophic breaches. Let's break it down. I'm gonna start off this presentation by talking a little bit about some magic numbers from the previous year. So the first number is two hours and two hours is the time on average that it takes for a malicious actor to get from the first initial breach. Let's say they breach your VPN router, for example, or VPN gateway. Two hours is the average time that it takes from that event to full domain compromise or full Azure AD tenant compromise. So I would say that's a relatively short time. And the next number is very contradicting because 180 days on the other hand is the average that they use before they show up anything on your screen saying that you're ransom door. So 180 days and two hours, very different. What can we learn from this? Well, one thing I think you should learn is that 180 days is the time of logs you should have at least. So compared to the defaults of Microsoft Defender for endpoint for 30 days, for example, that's very low. Now, why is it 180 days? That's because of how the industry is built. So now previous years, almost as big as ransomware has been, which is credential harvesting and access harvesting. This means that they actually go into your environments. They figure out a username and password for your router. And then they sell that information to someone else because it's easier to let someone else do the heavy lifting. Why would you go through all the trouble of keeping your customer engaged with your ransomware event? So just sell it to someone with 10th of the price but have 10 of them and you get the same money. Simplify, secure, succeed. Learn how tiering can safeguard your organization. Watch the full webinar now.

TL;DR

  • Threat actors can compromise entire domains or Azure AD tenants in an average of two hours from initial breach, highlighting the speed of modern attacks.
  • Organizations should maintain at least 180 days of security logs, significantly exceeding Microsoft Defender for Endpoint's 30-day default retention period.
  • Credential harvesting and access brokering have become as significant as ransomware, with attackers selling compromised credentials to other threat actors rather than executing attacks themselves.

Summary

This promotional clip highlights the critical importance of privilege tiering in directory security, emphasizing the stark contrast between attack speed and detection timelines. The presenter reveals that threat actors can achieve full domain or Azure AD compromise in an average of just two hours from initial breach, yet remain undetected for approximately 180 days before deploying ransomware. This disparity underscores the need for extended log retention—at least 180 days compared to Microsoft Defender for Endpoint's default 30-day retention—to enable effective forensic investigation. The content also addresses the evolution of the threat landscape, noting that credential and access harvesting has become nearly as prevalent as ransomware itself, with attackers increasingly selling compromised credentials rather than executing attacks directly. The clip serves as a teaser for a full webinar on implementing practical tiering models to prevent lateral movement and contain breaches.

Chapters

0:00 - Introduction to Privilege Tiering
0:10 - Attack Speed Statistics
1:00 - Log Retention Requirements
1:20 - Credential Harvesting Trends

Key Quotes

0:15 "Two hours is the average time that it takes from that event to full domain compromise or full Azure AD tenant compromise."
0:47 "... 180 days on the other hand is the average that they use before they show up anything on your screen saying that you're ransom door."
1:20 "Now previous years, almost as big as ransomware has been, which is credential harvesting and access harvesting."

FAQ

Why do organizations need 180 days of log retention when attacks happen in hours?

While attackers can compromise a domain in two hours, they typically wait an average of 180 days before deploying ransomware or revealing their presence. This extended dwell time means organizations need sufficient log history to investigate the full attack chain and identify the initial breach point, which may have occurred months before detection.

How does privilege tiering help prevent rapid domain compromise?

Privilege tiering separates administrative access levels to contain breaches and prevent lateral movement. By implementing proper security controls at each tier—from domain admins to workstation admins—organizations can stop attackers from escalating privileges and moving from an initial breach point to full domain compromise within the critical two-hour window.


Categories:
  • » Webinar Library » Netwrix
  • » Data Protection
Channels:
News:
Events:
Tags:
  • Identity & Access
  • Threat Intelligence
  • Best Practices
  • Getting Started
  • Webinar
  • Privilege Tiering
  • Identity Threat Detection
  • Active Directory Security
  • Azure AD Security
  • Credential Harvesting
  • Ransomware Defense
  • Log Retention
  • Lateral Movement Prevention
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: Directory Security Through Privilege Tiering

              Upcoming 360 View Events

              • Nov
                19

                360View: Govern, Secure & Recover Your Microsoft 365 Environment

                11/19/202601:00 PM ET
                More events

                XStreaminars (watch here)

                • Oct
                  28

                  EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure

                  10/28/202601:00 PM ET
                  More events

                  Industry Events (Sponsor Hosted)

                  • Oct
                    15

                    Risk in Real Time Demo Series: Virtual Patching: Protection at the Speed of Exploitation

                    10/15/202611:00 AM ET
                    • Oct
                      20

                      Harnessing Data Governance for AI with Cyera and Snowflake

                      10/20/202611:00 AM ET
                      • Oct
                        27

                        Maximize Your Microsoft Investment for Security and Growth

                        10/27/202611:00 AM ET
                        • Oct
                          27

                          The HUMAN Experience: Real-Time Insights into Page Intelligence

                          10/27/202601:00 PM ET
                          • Oct
                            28

                            [APAC:] Secure AI Everywhere: Visibility, governance and protection for the agentic era

                            10/28/202601:00 AM ET
                            More events

                            Upcoming Webinar Calendar

                            • 10/15/2026
                              11:00 AM
                              10/15/2026
                              Risk in Real Time Demo Series: Virtual Patching: Protection at the Speed of Exploitation
                              https://www.truthinit.com/index.php/channel/1372/risk-in-real-time-demo-series-the-autonomous-era-orchestrating-a-resilient-enterprise/
                            • 10/20/2026
                              11:00 AM
                              10/20/2026
                              Harnessing Data Governance for AI with Cyera and Snowflake
                              https://www.truthinit.com/index.php/channel/2137/harnessing-data-governance-for-ai-with-cyera-and-snowflake/
                            • 10/27/2026
                              11:00 AM
                              10/27/2026
                              Maximize Your Microsoft Investment for Security and Growth
                              https://www.truthinit.com/index.php/channel/2178/maximize-your-microsoft-investment-for-security-and-growth/
                            • 10/27/2026
                              01:00 PM
                              10/27/2026
                              The HUMAN Experience: Real-Time Insights into Page Intelligence
                              https://www.truthinit.com/index.php/channel/2139/the-human-experience-real-time-insights-into-page-intelligence/
                            • 10/28/2026
                              01:00 AM
                              10/28/2026
                              [APAC:] Secure AI Everywhere: Visibility, governance and protection for the agentic era
                              https://www.truthinit.com/index.php/channel/2125/apac-ensuring-comprehensive-security-for-ai-applications/
                            • 10/28/2026
                              06:00 AM
                              10/28/2026
                              [EMEA:] Secure AI Everywhere: Visibility, governance and protection for the agentic era
                              https://www.truthinit.com/index.php/channel/2127/emea-ensuring-ai-security-across-all-platforms/
                            • 10/28/2026
                              01:00 PM
                              10/28/2026
                              [AMERICAS:] Secure AI Everywhere: Visibility, governance and protection for the agentic era
                              https://www.truthinit.com/index.php/channel/2126/securing-ai-across-the-americas-strategies-and-insights/
                            • 10/28/2026
                              01:00 PM
                              10/28/2026
                              EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure
                              https://www.truthinit.com/index.php/channel/2179/envzero-near-zero-time-to-resolution-live-agentic-remediation-for-failed-and-drifted-infrastructure/
                            • 11/04/2026
                              11:00 AM
                              11/04/2026
                              Aligning Agentic Intent: Understanding Your Agents' Purpose vs. Their Actions
                              https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-purpose-vs-their-actions/
                            • 11/05/2026
                              02:00 PM
                              11/05/2026
                              HUMAN Dialogue: Embracing the Rise of the Agentic Consumer in AI
                              https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-agentic-consumer-in-ai/
                            • 11/05/2026
                              02:00 PM
                              11/05/2026
                              Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption
                              https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
                            • 11/19/2026
                              01:00 PM
                              11/19/2026
                              360View: Govern, Secure & Recover Your Microsoft 365 Environment
                              https://www.truthinit.com/index.php/channel/2076/360view-govern-secure-recover-your-microsoft-365-environment/
                            • 11/19/2026
                              01:00 PM
                              11/19/2026
                              Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents
                              https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/
                            Truth in IT
                            • Sponsor
                            • About Us
                            • Terms of Service
                            • Privacy Policy
                            • Contact Us
                            • Preference Management
                            Desktop version
                            Standard version