Active Directory security is built from several controls that answer different questions. Posture assessment asks whether the directory is configured safely. Threat detection asks whether an identity is behaving like an attacker. Access control asks whether a login should proceed. Auditing asks what changed. Recovery asks how to restore. Change enforcement asks whether a modification to a protected host was authorized.
The layers
- Posture assessment: Is the directory configured safely, and what paths to privilege exist? Examples: Netwrix PingCastle and ISPM, Semperis Purple Knight.
- Identity threat detection: Is this identity behaving like an attacker? Examples: Vectra AI, CrowdStrike Falcon Identity Protection, Semperis DSP.
- Access decision: Should this authentication proceed? Examples: CrowdStrike Falcon Identity Protection, conditional access policy.
- Change auditing: What changed in the directory, and can we prove it? Examples: Netwrix Auditor, Semperis DSP.
- Recovery: How do we restore the forest after compromise? Examples: Semperis ADFR, Netwrix Identity Recovery.
- Change enforcement: Was this modification to a protected host authorized? Example: Mimic.
What each vendor actually does
Semperis. Directory Services Protector provides continuous threat monitoring for AD and Entra ID with automated remediation and rollback of malicious changes, including point-in-time recovery of directory state. It reads the AD replication stream, which captures changes even when security logging is off or agents are disabled, and detects techniques such as DCShadow that bypass log-based auditing. Active Directory Forest Recovery automates post-incident forest recovery, a category where independent analysts have described Semperis as close to alone. Purple Knight is a free assessment tool.
Netwrix. A broad portfolio covering change auditing, identity security posture management with risk checks mapped to MITRE ATT&CK, attack path analysis, configuration drift alerting, access governance, and compliance reporting mapped to HIPAA, PCI DSS, GDPR, SOX, CMMC and NIST. PingCastle provides free AD assessment against MITRE ATT&CK and ANSSI frameworks. The Directory Security capability includes granular recovery for AD, Entra ID and Okta alongside automated forest recovery.
Vectra AI. Behavioral threat detection across network, identity, cloud and SaaS through Attack Signal Intelligence. Identity detections surface credential theft, account compromise and privilege escalation across both human and machine identities. The platform is agentless, which is deliberate: Vectra’s own material notes that endpoint agents cover a limited share of a typical environment and that unmanaged assets create blind spots.
CrowdStrike Falcon Identity Protection. Real-time protection for Entra ID against password spraying, phishing and lateral movement, with risk-based access decisions integrated directly into Entra ID authentication flows through Microsoft’s External Authentication Method. It combines identity risk with device risk from the Falcon sensor, which is a genuine advantage of running both.
Mimic. Kernel-level change enforcement. Protected systems including domain controllers are profiled in their authorized operational state, and every attempted change is evaluated against that baseline before it executes. Enforcement is identity-agnostic. Mimic does not assess AD configuration, does not detect identity threats behaviorally, and does not perform AD recovery.
Why these compose rather than compete
Each layer fails in a different direction, which is what makes the stack worth building.
Posture assessment reduces how many paths exist but cannot stop an attacker on one of them. Threat detection recognizes abnormal identity behavior but a privileged account doing privileged things is not abnormal. Access control evaluates the authentication event but not the twenty actions after the session opens. Auditing records what changed but recording is not preventing. Recovery restores the directory but only after the attack succeeded.
Change enforcement answers whether a modification to a host was authorized. It does not tell you the directory is misconfigured, does not recognize an account behaving strangely, does not produce a directory-level audit trail in the form a compliance auditor expects, and cannot restore a forest.
The practical implication is that the sequence matters more than the selection. Posture assessment first, because it is often free and it tells you which of the remaining problems are actually yours. Recovery second, because the cost of not having it is unbounded. Detection and enforcement after that, in whichever order matches the exposure the assessment found.
For the framing that underpins this page, who can act versus what can change, start with Active Directory security. For what the enforcement layer looks like in a production AD estate, see how REI defended its Active Directory.
The layers of AD security, answered.
Is Mimic an alternative to Semperis?
+No. Semperis provides AD-specific threat monitoring, rollback of malicious directory changes and automated forest recovery. Mimic does none of those. It enforces change at the host kernel, evaluating whether a modification to a protected system was authorized. The two address different layers and organizations serious about AD security commonly need both.
Do I need change enforcement if I have AD auditing?
+They answer different questions. Auditing records what changed, which is what investigation and compliance require. Enforcement determines whether the change executes at all. An audit trail of a change that already happened and a control that prevented it are different outcomes, and most compliance frameworks want evidence of both.
What is the difference between ITDR and change enforcement?
+Identity threat detection and response identifies attacks against identity infrastructure through behavioral analytics and posture assessment, and typically responds by alerting, disabling an account or rolling back a directory change. Change enforcement evaluates whether a specific modification to a protected host was authorized, before it executes, without reference to the identity that requested it.
Which Active Directory security tool should we buy first?
+Start with a free configuration assessment, because it costs nothing and tells you which problems are yours. Then ensure you have tested recovery, since the cost of not having it is unbounded. Detection and enforcement follow, prioritized by whatever the assessment surfaced as the largest remaining exposure.
Can one product cover all of Active Directory security?
+No vendor currently covers posture assessment, behavioral threat detection, access control, change auditing, forest recovery and host change enforcement well. Several cover two or three. Evaluating on which layers you already have rather than on feature-count comparisons produces better decisions in this category.
Does change enforcement replace Active Directory recovery?
+No. Enforcement reduces the likelihood of needing recovery by preventing unauthorized change on protected hosts. It does not restore a directory that has been damaged, and no organization should treat any preventive control as a substitute for tested recovery. Both belong in an AD program.
