AD CS vs Smallstep PKI ROI Calculator

One compromised admin credential, used through Stryker's own Microsoft Intune console, wiped tens of thousands of devices across 79 countries. No malware was deployed and no software vulnerability was exploited; reporting indicates MFA was not consistently enforced on the account and multi-admin approval was not enabled. Surgeries were delayed and hospitals could not order equipment. Stryker filed an SEC 8-K; Reuters reported the financial impact undisclosed. That absence is why the model above prices exposure from your own revenue rather than borrowing a headline number.

Vulnerability exploitation is now the #1 initial access vector (31%) — but credential abuse still appears in 39% of all breaches across the full attack chain: attackers get in, then pivot to credential dumping, privilege escalation, and lateral movement. That escalation layer is where AD CS abuse lives, and it is what this line prices — not patching. Ransomware appeared in 48% of breaches, and 73% of ransomware victims had an infostealer or credential-leak event in the prior year.

Credential stealers rose as a share of malware observed in frontline investigations, and Mandiant's leading recommendation is continuous identity verification with strict least privilege. Hardware-bound, non-exportable device credentials directly counter the stolen-credential reuse chain.

AD CS attacks rarely need zero-days or malware: adversaries misuse native certificate issuance to impersonate privileged accounts and persist. Unit 42 reports these weaknesses are actively exploited by both ransomware groups and state-sponsored actors.

The foundational research on AD CS abuse. It identified eight privilege-escalation categories; the catalogue has since grown to 17 distinct ESC techniques, with open-source tooling (Certipy) automating their discovery and exploitation.

Misconfigurations can hand effectively any domain user a path to domain admin: "we regularly find at least one AD CS issue in customer engagements."

US average breach cost reached a record $10.22M (global: $4.44M). The breach line is amortized — cost × annual probability × a conservative identity-attributable share — not a claim that every breach traces to ADCS. FBI IC3 loss totals run far lower because, per the FBI's own disclaimer, they exclude lost business, remediation costs, and unreported amounts.