Kay Daskalakis

🛡️ Visually helping to spread the message #DefenceInDepth starts with #Identity @SpecterOps - Tweets, satire and harmless opinions are my own.

[Kay Daskalakis @KayDaskalakis]

> They didn't break in. They followed the path you built.

#AttackPathBasics

[Kay Daskalakis @KayDaskalakis]

> The badge says visitor. The access says otherwise.

#AttackPathBasics

[Kay Daskalakis @KayDaskalakis]

The shift from service principals to user-based service accounts feels like progress until you realise what it actually means.

Now your automated workloads authenticate like humans. Same MFA exemptions. Same session lifetimes. Same inherited group memberships nobody audits.

We didn't solve the identity sprawl problem. We renamed it.

[Kay Daskalakis @KayDaskalakis]

Automatic attack disruption sounds like the dream. Isolate the device. Contain the threat.

But what if the compromised identity has already traversed three trust boundaries before the device gets flagged?

The device is one node. The identity is the path.

Disrupting the endpoint doesn't disrupt the graph.

[Kay Daskalakis @KayDaskalakis]

Something I keep coming back to.

Techniques change. Phishing, AiTM kits, poisoned pipelines. The vector shifts every quarter.

But the graph stays. The relationships, the trust chains, the inherited permissions. That structure is the constant underneath all the noise.

I think defending the graph matters more than chasing techniques. But I'm curious. Where do you spend most of your defensive energy?

[Kay Daskalakis @KayDaskalakis]

I've started wondering if "defence-in-depth" sometimes becomes "defence-in-debt."

60 Conditional Access policies. DPAPI keys nobody tracks. Certificate templates granting enrollment to Domain Users.

Layer after layer, but each one carrying its own unaudited risk.

Does anyone else feel like depth without visibility is just complexity in disguise?

[Kay Daskalakis @KayDaskalakis]

> He authenticated once. He's been everywhere since.

#AttackPathBasics

[Kay Daskalakis @KayDaskalakis]

@merill @opencode Hi Merill, perhaps unrelated but what would you suggest as Open Source LLM inside Azure to avoid eating up all AI Builder credits? Trying to move fast but builder credits keep running out on me :p

[Kay Daskalakis @KayDaskalakis]

@NathanMcNulty I mean that is what I understand this says as well. Can it be worded more confidently? Yes. Is it bad as is? Don’t think so.

[Kay Daskalakis @KayDaskalakis]

There's a scheduled task on a Tier-1 server I found recently. Running as Domain Admin.

Created in 2021. The person who made it left the company two years ago. Nobody reviewed it. Nobody questioned it.

It's a servant door. Quietly holding open a path nobody's watching.

How many of these do you think exist in your environment right now?

[Kay Daskalakis @KayDaskalakis]

Something I've been thinking about.

Most SOC analysts live in Kusto. Not Cypher. So when someone rebuilt BloodHound's queries in KQL for Sentinel, it felt like meeting defenders where they already are.

I think that's the pattern worth copying. Don't ask people to learn a new language. Bring the insight to their existing workflow.

What tools have you seen succeed because they met people where they already work?

[Kay Daskalakis @KayDaskalakis]

> Authenticate once. Traverse anything.

#AttackPathBasics

[Kay Daskalakis @KayDaskalakis]

An AI agent completed a 32-step corporate network attack in hours.

It didn't need zero-days. It walked through open doors. Misconfigured delegations, stale credentials, inherited permissions.

I think the uncomfortable part isn't that AI can hack. It's that the paths were already there waiting.

What's your take? Are we building for AI-speed adversaries yet?

[Kay Daskalakis @KayDaskalakis]

@_xpn_ You absolutely deserve it mate!

[Kay Daskalakis @KayDaskalakis]

"Apply security updates and try Cyber Essentials."

That's what AISI recommended after an AI agent compromised a corporate network in hours.

I wonder if we're past the point where patching alone is a credible response to structural identity problems.

What do you think? Is this guidance keeping pace with the threat?

[Kay Daskalakis @KayDaskalakis]

I keep finding permissions granted in 2019 that nobody's reviewed since.

Tier 0 access inherited through nested groups. Service accounts with Domain Admin that outlived the project they were built for.

It's not malice. It's just time doing what time does to access.

Anyone else doing regular access archaeology on their environment? What's the oldest permission you've found still active?

[Kay Daskalakis @KayDaskalakis]

@psionicjake Same effect for someone reading in 2026 that hasn’t kept up with every single AI development :p

[Kay Daskalakis @KayDaskalakis]

@martinsohndk @BSidesAarhus Love this man! Looking forward to put some time aside to do this some proper read!

Where would you suggest someone starts if they had only 15 mins to go through the highlights?

[Kay Daskalakis @KayDaskalakis]

I sat across from a CISO once. Fully patched. MFA everywhere. Logs shipping beautifully.

Then we showed them the graph. One path from helpdesk to Domain Admin through nested group memberships nobody had audited in years.

It's like an X-ray that shows a problem you didn't know you had.

How many of you have run that exercise on your own environment?

[Kay Daskalakis @KayDaskalakis]

@JohnLaTwC Thank you for sharing!

Which query sets would you say are most valuable for someone starting to dive into this world to understand it better?