Post-Quantum + Active Directory: A Perfect Storm for Attackers

In June 2025, the UK government committed £500 million to accelerate quantum technology, an unmistakable signal that quantum is imminent. While most businesses are still securing yesterday’s threats, the future is already knocking.

Now consider this: one of your IT assets many believe most critical, Active Directory, is likely vulnerable to the quantum threat. And if you’re still relying on outdated protections, you may be handing over the keys to your kingdom without even realising it.

The Quantum Threat Is Not Theoretical

Quantum computers are no longer a distant possibility. Nation-state actors are already harvesting encrypted traffic with the intent to decrypt it once quantum capabilities mature, a tactic known as “harvest now, decrypt later.” This makes every unprotected AD communication today a future breach in waiting.

LDAP, Kerberos, and DNS traffic between endpoints and domain controllers contain the keys to the kingdom. If harvested, that data could be decrypted later and weaponised to impersonate users, forge credentials, and bypass even the most advanced access controls. Once Active Directory is compromised, trust collapses, and that means your business can fail.

Unlike traditional malware campaigns, these are long-game strategies. Data stolen today will remain valuable for years. Access tokens, admin credentials, internal structures – all of it sits in transit inside AD communications, and all of it is up for grabs if left unprotected.

Active Directory Is the Ultimate Target

Attackers aren’t guessing passwords; they’re logging in. In 86% of breaches, stolen credentials are the root cause. And what validates those credentials? Active Directory. Once inside, attackers use tools like Mimikatz and BloodHound to enumerate AD, escalate privileges, and move laterally.

Here’s what’s at stake:

• Identity hijack: Attackers can impersonate users and access any system.
• Ransomware spread: Group policies can be weaponised to disable AV or push malicious payloads.
• Operational shutdown: User lockouts, login failures, and policy tampering halt productivity.
• Compliance collapse: A breach of AD is a breach of GDPR, DORA, HIPAA, and NIS2.

When AD goes down or is compromised, it’s more than an IT incident; it’s a business crisis. Your workforce is locked out, your customer data is at risk, and your compliance posture disintegrates.

We’ve seen this play out recently. In April 2025, Marks & Spencer was hit by a sophisticated ransomware attack that reportedly began with compromised credentials and culminated in the theft of their AD database. Despite strong internal controls, attackers exploited AD visibility to move laterally and deploy ransomware across the environment. The fallout included £300M loss in operating profit, a £1B drop in market value, and millions per week in lost sales, in addition to the overall disruption and huge reputational damage. 

This wasn’t an isolated incident. Other UK retailers were also targeted in similar campaigns, with attackers leveraging AD access to exfiltrate data and paralyse operations. These attacks highlight just how quickly hackers pivot from access to impact, and how vulnerable unprotected AD traffic can be, even in well-defended environments.

Why Traditional Cyber Protections Fall Short

TLS and IPsec were never designed for post-quantum resilience. They also depend heavily on endpoint trust and can be bypassed by insider threats or compromised devices. VPNs and VLANs offer complexity, not security. And they provide no visibility or auditability.

Endpoint detection can’t stop traffic-level exploitation. MFA and Conditional Access can’t stop credential forgery. If your strategy ends at the login screen, you’re missing the bigger threat.

Certes takes a fundamentally different approach.

Certes DPRM: Quantum-Ready Active Directory Protection

Certes Data Protection and Risk Mitigation (DPRM) solution cloaks AD traffic in deterministic, zero-access protection. Unlike identity-centric controls, Certes enforces policy at the transport layer using cryptographic segmentation. Here’s how:

• Post-Quantum Protection: Certes integrates post-quantum cryptography. This future-proofs your AD traffic against quantum decryption.
• No Keys on Endpoints: Encryption keys are never stored on devices or transmitted on the wire. Even if a device is compromised, there’s nothing to steal.
• Lateral Movement Prevention: Certes stops enumeration tools cold. Attackers can’t scan, interact with, or even see AD traffic unless they match policy.
• Audit-Ready Visibility: Real-time policy telemetry shows who accessed what, when, and how, without decrypting content. Essential for regulatory audits.

This is protection that assumes compromise, and still holds. Even if a threat actor breaches the network perimeter, Certes ensures they cannot gain any useful insight or access from AD traffic.

Protect the Core Before It’s Too Late

Active Directory is the backbone of IT systems. But it’s also a glaring vulnerability if traffic isn’t cryptographically protected. The quantum threat makes delay unacceptable.

Security isn’t just about firewalls and access control, it’s about visibility, assurance, and resilience. When you protect AD at the traffic level with post-quantum enforcement, you mitigate risk by eliminating attack paths.

Certes DPRM is already post-quantum ready. It ensures your AD traffic is invisible and inaccessible to attackers, even those harvesting data today for use tomorrow.

Because protecting AD is essential to protect your data and thereby the trust that keeps your entire organisation running.

Your Active Directory is too valuable, and too vulnerable, to rely on outdated protections. Certes DPRM delivers quantum-safe, zero-access control over the traffic that keeps your business running.

Ready to see how it works? Book a demo or request a callback and let’s make your AD invisible to attackers