2025 Purple Knight Report on Identity Security

The 2025 Purple Knight Report serves as a technical report detailing the ongoing challenges organizations face in securing hybrid Active Directory (AD) and Entra ID environments. The report presents findings from a survey conducted among users of the Purple Knight assessment tool, which evaluates security scores related to identity systems. The average initial score reported was 61%, indicating a failing grade and a decline of 11 points from the previous year. Notably, government agencies reported the lowest scores, reflecting resource limitations in addressing identity security. The report outlines that many organizations struggle with AD infrastructure security, particularly in managing AD Certificate Services, which have been targeted in significant cyberattacks. Despite these challenges, organizations utilizing remediation guidance from the Purple Knight report have seen improvements in their security scores, with some reporting increases of up to 61 points. The document emphasizes the need for ongoing assessments and strategic remediation efforts to enhance security postures.