Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

For an individual, self-hosting a password manager is rarely realistic. Most people don't run servers, handle patching, or manage uptime, so a cloud vault ends up being the only practical choice. For an organization, self-hosting becomes a real decision, one your security and IT teams can make deliberately. And once you can choose, you also take on the risks and the responsibility that come with that choice.

Netwrix formed a dedicated in-house Security Research team on July 15, 2025, led by Huy Kha, Director of Security Research. The team includes Senior Staff Security Researcher Darryl Baker, a recognized authority on Active Directory and identity security. They research identity, data security, AI, and cloud threats, with the goal of translating security research into practical improvements across Netwrix's product portfolio.

A few months ago, I attended a GC AI Summit hosted by Harvard Law School. As expected, there was plenty of discussion about AI tools, governance frameworks, emerging regulations, and the future of the legal profession. One topic of discussion stood out above the others: Most organizations only need to think about how they deploy AI, whereas we have to think about how we deploy AI and how we develop AI.

DLL hijacking is a decades-old Windows vulnerability class (Mitre Att@ck T1574) getting new life from AI plugins bolted onto legacy desktop apps. Attackers plant a malicious DLL where a vulnerable app will load it instead of the real one, inheriting that app's privileges. To detect it, watch for DLLs loaded by name from writable folders. To prevent it, you have to fix the app's load-order logic or blocking untrusted DLLs at the endpoint.

Netwrix Auditor earned a spot on the 2026 Capterra Shortlist for Cybersecurity Software and Compliance Software, plus a 2026 Software Advice FrontRunners placement. The recognition is grounded in 200+ verified reviews, with a 4.5 out of 5 rating and 95% positive feedback. Auditor is used by professionals across 13,000+ organizations, including 120+ Fortune 500 companies, who use it to unify visibility across hybrid IT environments and produce audit-ready evidence in real time.

A common misconception is that technology is to blame. That might not be true.

Organizations pushed toward Intune are hitting the same wall regardless of industry or size. Intune doesn't manage servers, can't do bare metal imaging, still lacks the OU-style hierarchy and delegation Group Policy admins are used to, and covers a fraction of the settings Group Policy has supported for 20 years, though that gap has narrowed. That's why so many IT teams are stuck running Group Policy and Intune side by side years past their planned cutover.

Netwrix's 2026 research found a 4x gap in breach rates between organizations where AI has significantly grown their identity count and those where it hasn't. Static credentials are AI’s easiest way in: passwords, keys, and tokens that never expire and never get checked. AI didn't invent the over-privileged credential, it just found the fastest way to use one.

A Reddit thread on r/activedirectory asking whether Active Directory is going away pulled in loads of comments, and the most upvoted answer compared AD to COBOL: still running, still critical, still not going anywhere. That comparison holds up when you check whether COBOL is still used today, since it runs core banking and government systems decades after its supposed retirement. The real risk for most IT teams isn't AD disappearing.

Most AI deployment policies stop at approved chat interfaces. Meanwhile, employees install browser copilots, AI extensions, and third-party plugins that never touch Microsoft's management stack. IT can't configure what it can't see, and Group Policy and Intune only govern Microsoft's world. This post covers what actually happens once AI tools show up outside policy, five things most teams miss, and how PolicyPak enforces controls directly on the apps and browser extensions themselves.