The Fast Path to the Top: Two Blind Spots Attackers Count On

Every environment has infrastructure that's trusted by default and watched by almost no one. Sometimes it's been sitting in your domain for a decade. Sometimes you deployed it last week. Either way, it's often the shortest route an attacker has to Enterprise Admin, Global Administrator, and everything underneath.

Across two sessions, Darryl Baker and Sander Berkouwer walk through two of these blind spots — one old, one brand new — and show how the same pattern plays out in both: a trusted component, a default or careless configuration, and an adversary who reaches the top faster than your audit logs can react.