By Chris Green, OSCP, CISSP, CISA, CRISC, CRISC, Structured GRC Director —

When I first published our observations on the most common findings from our penetration testing engagements back in 2022, the conversation around cybersecurity was at the time largely framed by a single geopolitical moment, one in which nation state tension and a steady drumbeat of CISA advisories made it easy to describe the threat landscape in terms of a specific adversary and a specific season of alarm.

Four years later, that framing feels almost quaint. The threats that once seemed exceptional have faded away, and the tools available to attackers, most notably generative and agentic AI, have compressed the time between the discovery of a vulnerability and its weaponization to a degree that would’ve blown our minds in 2022.

Surveys of the offensive security community now suggest that most practitioners, malicious and authorized alike, incorporate AI tooling into their daily workflow, using it to accelerate reconnaissance, generate exploit code, and triage the sprawling attack surfaces that modern organizations present.

That sprawl is itself the second major shift worth naming. Where our earlier findings were organized cleanly around public facing assets and internal, largely Windows and Active Directory-centric infrastructure, the reality our testing team encounters today is one in which the network perimeter has dissolved into a patchwork of cloud services, SaaS integrations, and a sharp increase in identity providers that span both on premises and cloud environments simultaneously.

The most consequential attack paths we uncover now rarely begin and end inside a single, tidy boundary. They begin with a phished credential or a stolen token, move through a misconfigured cloud role, and often terminate somewhere neither the client nor, frankly, most vendors would have predicted a few years ago.

Identity, more than any firewall or network segment, has become the perimeter that matters most, and it is worth revisiting our common findings with that reality in mind.

What’s Still at the Network Edge

Despite the shift toward cloud and identity, a handful of external findings remain extremely persistent, even as the mechanics behind them evolve. Authentication vulnerabilities are the clearest example. Multifactor authentication (MFA) is far more widely deployed than it was in 2022, yet we continue to find organizations where it’s inconsistently enforced across every public facing portal, and more importantly, we find that MFA itself is frequently able to be bypassed rather than simply absent.

Attackers have grown adept at OAuth consent phishing and token replay techniques, of which the recent ConsentFix, EvilTokens, and Kali365 campaigns are illustrative examples, that steal a live session or authentication token and render the presence of MFA almost irrelevant, since the attacker never needs to present a second factor at all. The lesson has shifted from simply turning MFA on to actively monitoring for anomalous token use and enforcing conditional access policies that account for device health and location.

Application and API vulnerabilities remain a dependable source of compromise as well, and if anything, the attack surface has grown given how many organizations now expose dozens or hundreds of APIs to support mobile applications, partner integrations, and internal automation. The typical OWASP top 10 categories, injection flaws, broken access control, and sensitive data exposure, would be familiar to anyone who read the original piece, but the pace at which they are discovered and chained together has accelerated considerably now that AI-assisted fuzzing and exploit generation are widely available to attackers of every skill level.

And finally, unpatched and outdated public facing systems get to keep their place on this list, a fact that says less about the difficulty of patch management and more about the growing number of internet-facing assets an average enterprise now maintains, many of them cloud hosted, ephemeral, or owned by a business unit the security team has never heard from directly.

When Cloud and Identity Collide in the Evolving Perimeter

This is the section that was still growing up when the original piece was written but deserves attention now because it represents the clearest evolution in how compromise happens today. Rather than a single network to breach, most organizations now present attackers with a layered set of identities: on-premises Active Directory accounts, cloud identities in Entra ID or a comparable provider, and often a hybrid trust relationship tying the two together.

Threat actors have adapted accordingly, and token theft has in many ways become more dangerous than traditional credential theft, since a password can be reset in moments while a stolen session token or refresh token may remain valid and unnoticed for hours or days. When our testers obtain a valid token through phishing or other exposure, the subsequent access often looks entirely legitimate to the defenses in place since the traffic resembles an ordinary employee session and the authentication event appears properly authorized.

Overly permissive cloud roles and service principals make the job easier. Where we once found Active Directory accounts with unnecessary local administrator rights scattered across a domain (still do), we now find cloud identities and automation accounts granted far broader permissions than their function requires, which allows a single compromised credential to pivot across storage, compute, and management resources that have no obvious relationship to one another.

Further, the boundary between on-premises and cloud compromises has grown thinner still. Recent security research has shown that misconfigurations in on-premises certificate infrastructure can, in hybrid environments, provide a path to full compromise of cloud resources as well, which means the old assumption that a cloud tenant is generally isolated from an on-premises breach no longer holds in many hybrid deployments.

The Inside Still Needs Work

Internally, Active Directory is still very much alive, and Active Directory Certificate Services (AD CS) has emerged as one of the single most consistently exploitable components we encounter.

AD CS is deployed in most enterprise environments, and it’s misconfigured almost as often as it is deployed. The certificate template misconfigurations first cataloged under the ESC1 designation have since expanded into a family of more than a dozen distinct escalation techniques, and tooling built to identify and exploit them has matured to the point that a low privileged domain user can frequently be escalated to full domain control within minutes. Given how directly these misconfigurations can also bridge into cloud compromise in hybrid environments, AD CS deserves to be treated as a first tier finding.

Kerberoasting and relay attacks, the two techniques that topped our internal findings four years ago, are still prevalent, but their utility to an attacker has narrowed considerably as endpoint detection and response (EDR) platforms and dedicated identity monitoring tools have grown more and more capable of flagging the anomalous ticket requests and relay traffic these attacks depend on.

The result is that sophisticated attackers have largely moved their tradecraft up a layer, relying instead on living-off-the-land techniques that weaponize legitimate, trusted binaries already present on the system, PowerShell, Windows Management Instrumentation (WMI), and certutil.exe among the most common.

These tools raise little suspicion because they are signed, expected, and permitted by policy, and a significant share of high-severity intrusions now involve no custom malware at all. Compounding this, many EDR platforms are built to observe endpoint behavior rather than the authentication layer itself, which leaves ticket forging and credential relay operating in something of a blind spot even on well-tooled networks.

Legacy name resolution protocols such as LLMNR and NetBIOS are still enabled by default on a surprising number of Windows environments and continue to hand attackers an easy path to captured credential hashes. Similarly, SMB signing is still inconsistently enforced across internal endpoints, which is why relay attacks remain practical even as identity monitoring has made them riskier elsewhere.

And file servers are still the gift that keeps on giving. While many organizations have migrated file storage to the cloud, those that don’t still have incredibly loose permissions with standard users holding access to shares well beyond their role. Sadly, this is a vulnerability that continues to hasten ransomware spread once a single account is compromised, a risk that has only grown given how far ransomware volume has climbed since our original findings were published.

Where This Leaves Us

The technical substance of penetration testing has not been upended so much as it has been layered, with cloud and identity risk sitting atop a foundation of Active Directory and network configuration hygiene that, four years on, remains quite familiar.

What’s changed is the speed at which attackers can move through that layered environment, aided considerably by AI tooling that shortens the distance between reconnaissance and exploitation, and the degree to which identity, rather than any network boundary, now determines the true shape of an organization’s attack surface.

Organizations that’ve spent the past several years hardening their on premises Active Directory environment while treating cloud and SaaS identity as someone else’s problem are likely to find that their attack surface has simply moved rather than shrunk.

Benchmarking against frameworks such as the NIST Cybersecurity Framework or the CIS Critical Security Controls is still incredibly valuable, but it needs to be paired with a comparable level of rigor applied to cloud identity providers, conditional access policies, and the hybrid trust relationships that now connect on-premises infrastructure to the cloud.

Regular assessment across all these layers, not just the ones that were easiest to test in 2022, remains the best strategy to staying ahead of an adversary that’s only grown faster.

Let’s see what the next four years bring.

About the Author

Chris Green excels at translating complex cybersecurity and compliance challenges into practical, business-focused strategies. He works collaboratively with executive leadership, IT teams, and stakeholders to build consensus, strengthen governance, and drive meaningful risk reduction. Known for his consultative approach and ability to align security initiatives with organizational objectives, Chris helps customers develop resilient programs that support compliance, improve decision-making, and foster long-term operational success.

Chris holds several certifications, including the OffSec Offensive Security Certified Professional (OSCP), ISC2 Certified Information Systems Security Professional (CISSP), ISACA Certified Information Systems Auditor (CISA), and Certified Risk and Information Systems Control (CRISC), demonstrating his ability to perform thorough penetration tests, audit a variety of environments against compliance standards, and manage and assess IT risks.