For years, cybersecurity leaders have focused on protecting endpoints, networks, applications, and data. Those investments remain critical. But the way attacks actually work has changed, and attackers have found a far more efficient path into enterprise environments.

Attackers are no longer breaking in. They’re logging in.

Phishing, credential theft, MFA fatigue attacks… attackers have figured out that the front door is easier than the window. Why exploit a vulnerability when you can just log in?

As a result, identity has become one of the most important battlegrounds in cybersecurity. Yet many organizations continue to focus their resilience strategies on data recovery while overlooking the systems that control access to that data. At ������Ƶ, we’re increasingly having conversations around a concept that wasn’t part of most cybersecurity discussions just a few years ago: identity resilience. It’s a topic we explored recently on the with Patrick Haverty and Parker Gaines from Rubrik, and the conversation reinforced just how wide the gap remains between where most organizations think they are and where they actually need to be.

Identity resilience may be one of the most important cybersecurity discussions happening today, yet many organizations have not addressed it directly. The data supports that concern. Investigations Report found that credential abuse was responsible for 22 percent of breaches analyzed, underscoring how often attackers gain entry through trusted identities rather than technical exploits.

Security leaders should ask a fundamental question: if an attacker compromises identity infrastructure, can the organization quickly recover? More importantly, can it recover with confidence?

The Stryker Lesson

A more recent example comes from the March 2026 cyberattack against medical technology giant Stryker. found that attackers gained administrative control over identity and device management systems and used that access to remotely wipe corporate endpoints across the organization, with no traditional ransomware involved.

The incident demonstrated a reality many organizations are only beginning to appreciate: attackers don’t need malware to create disruption. Control over the identity infrastructure is enough. And recovery gets especially hard when the systems you’d use to fix the problem are the same ones that got hijacked.

For security leaders, the lesson extends beyond healthcare. The same exposure exists whether the environment runs on Active Directory, Microsoft Entra ID, Okta, or a mix of identity platforms. Prevention alone doesn’t solve it. What matters is how quickly the organization can recover once trust in that infrastructure is gone.

What We’re Seeing in the Field

������Ƶ is seeing a growing disconnect between identity protection and identity recovery. Most organizations have done the work. MFA, PAM, Zero Trust, conditional access. Those investments matter. But every one of them is built around keeping attackers out. None of them answer the harder question: what happens when someone is already in?

The MGM breach in 2023 is a good example. Scattered Spider didn’t exploit a technical vulnerability. They called the help desk, impersonated an employee, got an MFA reset, and walked straight through the front door. Then they went after the identity layer itself. Whether that’s Active Directory, Microsoft Entra ID, Okta, or a combination of identity providers, compromising the systems that control authentication gives attackers a powerful path to disrupt business operations. The damage ran north of $100 million.

When we ask organizations how they would recover from a compromised identity platform, the conversation often becomes much less certain.

Today’s identity environments span Active Directory, Microsoft Entra ID, Okta, SaaS applications, cloud services, and hundreds of interconnected business systems. As those systems get more tightly woven together, a disruption in one identity provider ripples across the whole organization fast. Many have tested their backups. Far fewer have tested the recovery of the systems responsible for authenticating users, enforcing access policies, and establishing trust across the enterprise.

Most have invested heavily in protecting identities. Far fewer have a clear answer for what happens when those protections fail.

The New Reality: Attackers Target Trust

Recent high-profile attacks continue to demonstrate a common pattern. Attackers compromise a user account through phishing, credential theft, social engineering, or password reuse. Once inside, they escalate privileges, establish persistence, and begin targeting identity infrastructure.

Accessing data is often only part of the objective. What attackers really want is control over the environment itself. Who gets in, who gets locked out, and who decides. They get there by manipulating administrative accounts, group policies, identity providers, or access controls. Restoring that control is a harder problem than most recovery plans account for.

Why Traditional Recovery Strategies Fall Short

When identity infrastructure is compromised, organizations often face two difficult options.

The first is restoring from backup. Determining whether a backup represents a truly clean recovery point is where things become difficult. If an attacker maintains persistence in the environment before discovery, organizations risk restoring malicious changes alongside legitimate configurations.

The second option is rebuilding identity infrastructure from scratch. Whether the environment is centered on Active Directory, Microsoft Entra ID, Okta, or a hybrid identity architecture, recovery can quickly become a complex and time-sensitive exercise. Rebuilding forests, domain controllers, trusts, policies, permissions, and integrations can become a lengthy and error-prone process that places significant operational pressure on IT teams.

Neither option inspires confidence, and confidence is exactly what organizations need during a cyber crisis.

Most recovery strategies were built around attackers exploiting systems rather than authenticating into them. When a trusted identity becomes the vector, you need more than backup plans. You need to be able to rebuild confidence in the environment itself. It’s a problem Rubrik has spent considerable time solving, and it’s what drew us to partner with them on this.

How Rubrik Addresses the Identity Recovery Gap

Some of what Rubrik’s incident response team has documented stopped me cold. When companies try to rebuild Active Directory from scratch after an attack, the process fails roughly 80 percent of the time. The manual runbook runs about 150 pages. One step out of sequence and you go back to the beginning. And the people who know that process well enough to execute it when you are under real pressure? In most organizations, that’s one or two people. If they’re traveling, or on vacation, you have a serious problem on top of an already serious problem.

The “last known good” problem also came up in our conversation, and it’s worth dwelling on. Restoring from backup sounds straightforward until you realize you can’t always be certain the backup itself is clean. If an attacker had been sitting in the environment for weeks before discovery, you risk pulling their persistence right back in. Rubrik identifies clean recovery points automatically and won’t let you restore to a state that contains ransomware or anomalous activity. During an incident, that takes one very difficult question completely off the table.

At ������Ƶ, we talk a lot about being “left of bang” versus “right of bang” — preparing before an attack versus responding after one. Rubrik is genuinely built for both. Their posture monitoring identifies misconfigurations and overprovisioned privileges before anyone exploits them. The recovery side handles what comes next if prevention fails. What I keep coming back to is that they treat identity the same way mature security programs treat data: not just something to protect, but something you actually have to be able to recover. That’s a different standard than most of what I see in the market.

Are You Prepared to Recover Trust?

Most security leaders can identify their RTO for data recovery, although fewer know how long it would take to restore a compromised Active Directory, Entra ID, or Okta environment, or whether they’d even know what a clean recovery point looks like.

That’s the gap worth closing. No prevention strategy is perfect, and the organizations that weather attacks best are the ones who’ve already thought through what comes next.

MFA matters. Backups matter. But neither tells you what to do when authentication infrastructure itself is what’s been compromised. If your identity infrastructure went down tomorrow, would you know what to do? If the answer isn’t an immediate yes, that’s worth a conversation before it becomes a crisis.

Next Steps: A few years ago, identity recovery wasn’t on most security roadmaps. That’s changed fast. It is now a core component of cyber resilience, operational continuity, and business risk management.

������Ƶ helps organizations evaluate identity risks, validate recovery strategies, and identify gaps that traditional security and disaster recovery assessments often miss. Whether you’re assessing Active Directory, Microsoft Entra ID, or Okta dependencies, modernizing identity architecture, or evaluating your ability to recover from an identity-based attack, our team can help you develop a practical path forward. If you’d like to see Rubrik’s identity recovery in action before making any decisions, we can also arrange access to their hosted lab environment where you can run real recovery scenarios without touching your production systems.

If you’re not completely confident in the answer, now is the time to find out, not during a cyber incident.

Frequently Asked Questions

What is identity resilience in cybersecurity?

Identity resilience refers to an organization’s ability to recover its identity infrastructure, including Active Directory, Entra ID, Okta, and access management systems, after a cyberattack or outage. It goes beyond identity protection to address what happens when prevention fails.

How do organizations recover Active Directory after a ransomware attack?

Recovery typically involves restoring from a known clean backup or rebuilding from scratch, and the same challenge applies to Entra ID and Okta environments. Both options are complex. The bigger challenge is confirming the backup itself is free of attacker persistence before restoring it.

What did the 2026 Stryker attack reveal about identity resilience?

The Stryker attack gave attackers administrative control over the company’s identity and device management systems, which they used to remotely wipe devices across the organization. No ransomware was involved, since control over identity alone was enough to cause the damage.

What is the difference between identity security and identity resilience?

Identity security focuses on preventing unauthorized access through tools like MFA, Zero Trust, and privileged access management. Identity resilience focuses on recovering trust and access after those protections have been breached.

The post When Identity Infrastructure Fails, Can Your Business Recover? appeared first on IT Solutions Provider - IT Consulting - Technology Solutions.

Over the past decade working with security leaders and SOC teams across industries, I’ve seen the same pattern repeat itself across organizations of every size: security teams may have more visibility than ever before, yet analysts are still overwhelmed trying to determine which alerts actually matter.

Modern IT environments generate enormous volumes of telemetry across cloud platforms, SaaS applications, endpoints, networks, and identity systems. Each platform produces valuable signals, but the combined volume can overwhelm L1 SOC analysts who must decide which alerts require investigation.

This challenge is something we recently discussed with Blaine Brennecke, Director of Security Operations at Bottomline, during a customer conversation about .

“Security teams today are flooded with alerts,” Brennecke explained. “The challenge isn’t collecting more security data. It’s being able to analyze that data quickly enough to identify what actually matters.”

Bottomline’s experience reflects a broader shift happening across the industry. As their security team modernized its SOC environment, they partnered with ������Ƶ and AI-driven security automation provider Simbian to rethink how alerts are investigated, triaged, and prioritized.

Their journey highlights a reality many security leaders are now confronting: modernizing the SOC requires more than deploying new tools.

How the SOC Became a “Rube Goldberg Machine”

When I first began working closely with SOC teams and CISOs, most SecOps environments were relatively simple. Teams monitored a handful of core systems using a SIEM, endpoint protection tools, and basic network monitoring. But as today’s CISO’s know, average enterprise environments are much more intricate.

Organizations now operate across hybrid infrastructures that include , remote endpoints, SaaS applications, distributed workloads, and identity-driven access systems. Each environment generates its own telemetry, and analysts must correlate signals across all of them during an investigation.

Over time, the way many SOCs have evolved reminds me of a Rube Goldberg Machine, pictured below. New tools are deployed to solve legitimate visibility gaps, but each platform introduces its own alerts, dashboards, and investigation workflows. The system is an overly complex solution to a relatively straightforward problem. It is over designed and difficult to maintain… but make it less effective. 

Some tools integrate with each other. Some share data with the SIEM. But more often than not, the real integration layer ends up being the SOC analyst sitting in front of the screen.

SOC analysts frequently move between multiple systems just to gather enough context to determine whether activity represents a real threat. Investigations that should take minutes can take far longer when signals must be correlated manually across platforms.

The Operational Reality Inside Today’s SOC

During a recent , Senior Director of Security Operations at Bottomline, we discussed challenges that nearly every SOC leader we work with across the market recognizes.

Brennecke’s experience reflects a broader reality across the industry. SOC teams now have unprecedented visibility into their environments. But visibility alone doesn’t solve the operational challenge of detecting and responding to threats quickly enough.

Security analysts must still investigate alerts, correlate signals across tools, and determine whether suspicious activity represents a real attack.

At the same time, security leaders are being asked to improve detection and response capabilities while managing constrained budgets and limited staffing. As Brennecke put it, “A lot of organizations are in the same bucket today. Do more, do it faster, and do it with less.”

To address these challenges, Bottomline began evaluating ways to modernize its investigation workflows. That included exploring new approaches to automation and AI-driven alert analysis.

Working with ������Ƶ and Simbian, Bottomline introduced new investigation workflows that help analysts start their work with significantly more context around each alert.

Instead of manually stitching together data from multiple systems, analysts can begin investigations with a clearer picture of what’s happening across the environment.

The Challenges Driving SOC Modernization

Organizations attempting to modernize their SOCs typically encounter several common challenges.

Alert Fatigue: Security analysts may receive thousands of alerts each day from multiple detection tools. Without effective prioritization, distinguishing meaningful threats from routine activity becomes extremely difficult.

Tool Fragmentation: Security technologies deployed across network, endpoint, cloud, and identity environments often operate independently. Each platform produces its own alerts and dashboards, forcing analysts to gather context from multiple sources during an investigation.

Security Data Volume: This is growing as organizations expand their digital infrastructure. Traditional SIEM architectures can struggle to scale efficiently as log volumes increase.

Staffing Constraints: Experienced SOC analysts remain in high demand, and many organizations struggle to recruit and retain the talent needed to manage increasingly complex environments.

These operational pressures are forcing security leaders to rethink how their SOCs are designed and operated.

Why Technology Alone Doesn’t Solve the Problem

SIEM platforms, extended detection and response technologies, and emerging AI-driven investigation tools are helping SOC teams analyze large volumes of telemetry more efficiently. Technologies like Simbian’s AI-driven SOC automation platform can ingest alerts from existing security tools and perform automated investigation and triage steps that traditionally required significant analyst time.

When deployed effectively, these platforms reduce the number of alerts that require manual analysis while helping analysts focus on higher-priority threats.

But deploying new technology without rethinking workflows rarely delivers the results organizations expect.

Analysts still spend significant time investigating alerts manually because the surrounding processes and architecture haven’t evolved alongside the tools. That’s why successful SOC modernization efforts focus not just on technology, but also on architecture, operations, and engineering discipline.

Moving Security “Left of Bang”

������Ƶ’s approach to SOC modernization focuses on helping organizations move their security posture Left of Bang. The concept refers to identifying and disrupting threats earlier in the attack lifecycle so security teams can prevent incidents before they cause operational damage.

Achieving this shift requires a combination of architecture design, technology integration, and operational optimization.

Our cybersecurity experts work closely with organizations to design architectures that unify telemetry across network, endpoint, identity, and cloud environments. This allows SOC teams to investigate threats with greater context and reduces unnecessary signals across multiple platforms.

We also focus heavily on how technologies integrate with one another. Security tools deliver the most value when analysts can move seamlessly between systems during investigations rather than manually stitching together context.

Operational workflows are another critical component. Automation and AI can dramatically reduce repetitive investigation tasks, allowing analysts to focus on deeper threat analysis rather than spending hours triaging alerts.

Through ������Ƶ’s demo and integration labs, organizations can also test new security architectures before deployment. This validation process helps reduce implementation risk and ensures that new technologies deliver measurable improvements to SOC operations.

Building the Modern SOC

As organizations like have discovered, SOC modernization is no longer optional. Attack surfaces continue to expand, and the amount of security data generated by modern infrastructure continues to grow. Security teams must adopt new approaches to detection and response if they want to keep pace with evolving threats.

must process large volumes of security data, prioritize high-risk threats, automate investigation workflows, and detect suspicious activity earlier in the attack lifecycle.

For many organizations, this shift is already underway.

“You’re no longer starting from square one,” Brennecke explained. “You’re starting 80 percent of the way down the triage pipeline.”

That change fundamentally alters how SOC analysts spend their time. Instead of sorting through large volumes of alerts, analysts can focus on deeper investigation and response activities.

Achieving this kind of transformation requires integrated architecture, operational alignment, and experienced engineering guidance. Organizations that take this approach are finding they can improve threat detection while reducing the operational burden placed on their SOC teams.

See How Bottomline Technologies Modernized Its SOC

Organizations evaluating SOC modernization initiatives often benefit from seeing how other security teams have approached similar challenges.

In our recent discussion with Bottomline Technologies, we explored how their security team partnered with ������Ƶ and Simbian to improve SOC visibility, reduce alert fatigue, and accelerate threat investigations across their environment.

Watch the full conversation to learn how Bottomline redesigned its SOC workflows and how new investigation models are helping analysts begin investigations nearly 80 percent of the way through the triage process.

Next Steps: Led by ������Ƶ’s cybersecurity experts and partnering with industry leaders, our cybersecurity assessments provide the insights needed to strengthen your defenses and ensure compliance. Whether you need to identify vulnerabilities, test your incident response capabilities, or develop a long-term security strategy, our team is here to help.

Contact ������Ƶ’s cybersecurity experts today to learn more about our assessments and discover how we can support your security goals. In the meantime,  featuring ������Ƶ cybersecurity assessments.

The post Lessons from Bottomline’s AI-Driven Security Operations appeared first on IT Solutions Provider - IT Consulting - Technology Solutions.

AI is reshaping cybersecurity’s opportunities and risks. While organizations are using AI in cybersecurity to strengthen defenses, adversaries are just as quickly finding ways to weaponize these same tools. IT leaders need to understand how AI is changing threat tactics, elevating attack sophistication, and challenging traditional defense models.

The Dual-Use Nature of AI in Cybersecurity

, former Executive Director of the Cybersecurity and Infrastructure Security Agency (CISA), Brandon Wales, formeremphasizes that AI capabilities can be used for good and evil. It can help defenders improve detection and response, but it also gives adversaries new capabilities to scale operations and increase precision.

AI in cybersecurity has become a race between defenders and attackers. Wales noted that while AI-assisted defenders initially held an advantage, that edge is shrinking as threat actors adopt similar capabilities. Tools, including large language models, publicly available GenAI platforms, and open-source datasets, allow malicious actors to automate research, identify vulnerabilities, and create convincing phishing or social engineering content with minimal expertise.

Brandon explained even simple AI applications are transforming how threat actors operate. For instance, automation allows them to generate code variations or test malware against common defenses without extensive technical skill. As a result, the cybersecurity community must prepare for a future where AI-driven threats will become routine rather than exceptional.

Examples of AI-Driven Threats Emerging in the Field

1. Phishing and Social Engineering at Scale
   Wales highlighted that AI enables adversaries to dramatically scale traditional phishing campaigns. Instead of sending generic messages, they can create tailored and contextually relevant content using generative models. AI can mimic tone, grammar, and brand identity, producing emails and texts far more convincing to recipients. The use of these tools has increased the number of successful phishing intrusions across industries.
   
2. Automated Vulnerability Discovery
   Another growing risk comes from AI’s ability to analyze large volumes of code and network data. Wales described how adversaries are using automation to discover vulnerabilities faster than defenders can patch them. What once required a team of skilled hackers can now be done through AI-enabled scanning and pattern recognition. The ability to locate exploitable weaknesses in real time is one of the most significant AI-driven threats facing enterprises today.
   
3. Malware Development and Adaptation
   AI allows attackers to generate, test, and modify malware automatically. Wales noted this capability gives adversaries a persistent advantage because they can quickly alter malicious code to avoid signature-based detection. This new era of polymorphic and adaptive malware underscores the urgent need for organizations to advance their own AI threat detection technologies.
   

How AI Threat Detection Can Help Defenders Regain the Advantage

Although AI has made attacks more efficient, it also provides defenders with new methods to counter them. Wales encouraged enterprises to use AI threat detection tools that analyze network traffic patterns and identify anomalies humans may miss. These systems can process billions of data points in seconds, offering insights that would otherwise be impossible to surface manually.

However, AI-driven defense comes with its own challenges. As Wales cautioned, AI systems are only as good as the data and training behind them. Poor-quality data or biased inputs can lead to blind spots that attackers exploit. Moreover, adversaries are beginning to use AI to probe defensive models, identifying where machine learning tools make predictable errors.

To maintain a competitive edge, organizations should adopt layered approaches to AI in cybersecurity:

• Continuous learning models that update as threats evolve.
• Human oversight to interpret AI findings and investigate anomalies.
• Data governance frameworks to ensure training data is reliable, representative, and secure.

These strategies help strengthen AI threat detection while minimizing the risk of manipulation or false confidence.

Strategic Implications for Executive Leadership

Wales emphasized AI will not replace cybersecurity professionals but will redefine their roles. Security teams must evolve from manual detection to managing and validating AI-assisted analysis. Leadership must invest in both technology and workforce training to stay ahead of AI-driven threats.

He also noted that adversaries’ use of AI will not be limited to nation-states or well-funded groups. As AI becomes more accessible, even smaller criminal operations and inexperienced hacktivists can deploy these tools. This democratization of capability means the threat environment will expand in both volume and variety.

For decision-makers, this reality demands proactive planning. AI must be integrated across cybersecurity operations, risk assessments, and response protocols. Organizations delaying adaptation risk being outpaced by attackers who are already integrating automation and generative tools into their workflows.

Final Thoughts

AI is permanently altering the cybersecurity domain. Both defenders and adversaries now operate at machine speed, and the side using AI more effectively will dominate the digital battlefield. For enterprise IT leaders, the path forward involves balancing innovation with vigilance, investing in AI threat detection, and maintaining human expertise to interpret and act on complex insights.

������Ƶ partners with organizations to build secure, intelligent infrastructures that anticipate and mitigate emerging cyber risks. Our experts help integrate AI responsibly into your security strategy while preparing your teams for the next generation of challenges. To learn how ������Ƶ can support your organization in defending against AI-driven threats, contact us today.

Next Steps: Led by ������Ƶ’s cybersecurity experts and partnering with industry leaders, our available cybersecurity assessments provide the insights needed to strengthen your defenses, optimize security investments, and ensure compliance. Whether you need to identify vulnerabilities, test your incident response capabilities, or develop a long-term security strategy, our team is here to help. Learn more by

The post How AI-Driven Threats Are Redefining Enterprise Cybersecurity appeared first on IT Solutions Provider - IT Consulting - Technology Solutions.