This blog details how attackers exploit Unconstrained Delegation in Active Directory to achieve domain takeover. You'll see a step-by-step breakdown of capturing a Domain Controller's TGT, why it's critical, and, of course, learn actionable steps to prevent this threat. Unconstrained delegation is a legacy Active Directory feature that allows specific systems or services to impersonate users across the domain, allowing easier authentication between services. However, when left enabled on a compromised machine or misconfigured, it provides attackers a straightforward path to complete domain compromise. By coercing a privileged system like the Domain Controller into authenticating against a compromised host, attackers can capture TGTs (Ticket Granting Tickets). Capturing these TGTs enables attackers to impersonate any user or system in the domain, gaining unrestricted access to sensitive resources and allowing devastating attack techniques such as credential dumping, DCSync, and persistence through Golden Tickets. This blog provides a detailed, practical breakdown of attackers' exact methods to exploit this scenario. Additionally, it covers robust, actionable strategies to identify, mitigate, and prevent Unconstrained Delegation abuses within your Active Directory enterprises.

If you work in cybersecurity, you already know the feeling of having more to investigate than hours in the day. The security research backlog grows while you sleep. Threat feeds update faster than you can read them. Incident reports pile up. So when AI tools showed up offering to help with all of it, of course, you went all in. You spun up agents. You burned through tokens. And then somewhere around your third active subscription, you realized you might have a problem. At Sentry, we refer to it as tokenmaxxing (although NYT published some article defining it differently, if you were at BSides Sofia, you know who coined it first!) TL;DR (Lazy Summary)

Prompt injection is OWASP's #1 ranked vulnerability for LLM applications, but the term covers two fundamentally different attack classes. Semantic prompt injections manipulate meaning. They use natural language to trick the model into interpreting a malicious instruction as legitimate. Token-based injections exploit the tokenization layer itself: techniques such as injecting reserved delimiters, gradient-optimized adversarial suffixes, and quirks in how tokenizers split input into subwords. The two classes exploit different layers of the stack, succeed under different conditions, and require different tools to test.

If you are building or improving a SIEM, start with the logs before you start with the rules. A detection rule is a query over stored events. It works only when the SIEM receives the events the rule expects, parses the fields analysts need, and keeps the data long enough for an investigation.

From zero-trust architects to AI threat hunters — the roles, the numbers, and the opportunity hiding in plain sight.

One of the most common misconceptions about cybersecurity is that it’s a single job. It isn’t. It’s an ecosystem of deeply different specializations — some deeply technical, some strategically oriented, some sitting at the intersection of law, risk, and technology. A penetration tester and a GRC specialist both work in “cybersecurity,” but their day-to-day work, their skill sets, and their career trajectories have almost nothing in common.

The numbers are almost absurd. Nearly 4.8 million cybersecurity positions sit unfilled globally — a gap that grew 19% in a single year. In the United States alone, roughly 700,000 roles have no one to fill them. Meanwhile, recruiters are cold-messaging professionals who aren’t even job hunting, with close to 46% of cybersecurity workers receiving outreach every week.