Topics

Attacks against on-premises Active Directory and how to secure it. A series of articles in iX appeared in 2020, followed by two iX kompakt special issues in 2022 and 2023. The workshop “Angriffsziel lokales Active Directory” has been running since 2022. The more recent pieces deal with NTLM and tiering, and with luring attackers into honeypots.

Attacks with AI and on AI. Language models and agents help attackers with vulnerability research and, by now, with the attack itself. Companies that use them have to secure them in turn. There are two articles and a talk on the attack by OpenAI agents on Hugging Face.

Attacks on Azure, Entra ID and AWS and how to secure these environments. Azure came first, in 2022, with a series of articles in iX and workshops that ran until 2024; back then Entra ID was still called Azure Active Directory. AWS followed in 2024, with a workshop of its own and three iX articles from 2025.

Approaches that are not tied to any one system. A main focus is attacking your own environment with free tools before someone else does; other pieces cover OSINT, malware, living off the land and honeypots. In 2023 came talks on the security myths that many companies fall for.

Configuring Microsoft 365 and Entra ID securely, protecting them with Defender and reading the cloud logs after an incident to see what happened. The webinar series “M365 Security” at heise academy covers this in five parts. The older pieces date from the time when Entra ID was still called Azure Active Directory.

Attacks on web applications and APIs along the OWASP Top 10 and the OWASP API Security Top 10, and what developers can do about them. Most of the talks on this were given at developer conferences between 2019 and 2024.

In Windows networks, attackers get a long way with what the system already ships with, PowerShell above all. That was the subject of a six-part blog series in 2018, from the basics to forensics. The more recent pieces show how administrators harden clients, servers and authentication, for example with tiering and Privileged Access Workstations.