Your files stay here. Not uploaded.

Showing the Clearstone sample so you can see the brief. It is not your environment. Replace it with your exports before you share this.

Sophos

ITDR · LEAVE-BEHIND

Sample · not your environment

Identity threat detection

Clearstone Global

Evidence from the ITDR Trial period

As of 29 Oct 2026 · Window 24 Feb 2026 – 29 Oct 2026 · Confidential

4 active people have a plaintext password on the dark web, and none of them have MFA. Domain lockout is off, so those passwords can be guessed without the account ever locking. 64 findings were closed in this export, and new ones kept pace. This PDF is the day the trial can show. It is not the control.

117

Open findings

Still true in your export

23

High or critical

Address before the trial ends

4

Live plaintext

Active people, password not rotated

64

Closed in window

17 of them were high

Counts by severity

Open findings only. The export score maps 0.80 critical, 0.60 high, 0.40 medium, 0.20 low, 0.00 info.

Critical
1
High
22
Medium
34
Low
7
Info
53

Top five findings

  1. 1

    Domain-linked Group Policy shall enforce account lockout

    Failed guesses never lock the account. A leaked password can be tried until it works.

    Default Domain Policy

    Critical · 1

  2. 2

    Plain text password leak identified

    The password itself, not only a hash, is in a breach tied to someone in this directory.

    Markus Schneider · Liam Thompson · Michael Johnson · Takeshi Yamamoto

    High · 5

  3. 3

    Phishing-resistant MFA shall be enforced for all users

    Nothing forces a phishing-resistant factor. A pushed prompt or a one-time code is still enough.

    High · 1

  4. 4

    Tenant shall have baseline policy for MFA for all users and applications

    There is no tenant rule that requires MFA for every user and every app.

    High · 1

  5. 5

    Legacy authentication shall be blocked

    Older sign-in protocols that skip MFA are still allowed.

    High · 1

Active exposures

  • Liam Thompson

    No MFA

    Finance · Australia · paidwork.com · 30 Jul 2026 · Last active 28 Oct 2026

  • Markus Schneider

    No MFA

    IT · Germany · go-bus.com · 30 Jul 2026; go-bus.com · 30 Jul 2026 · Last active 28 Oct 2026

  • Michael Johnson

    No MFA

    Operations · United States · fluke.com · 30 Jul 2026 · Last active 19 Sep 2026

  • Takeshi Yamamoto

    No MFA

    Operations · Japan · fluke.com · 30 Jul 2026; forum.kodi.tv · 30 Jul 2026 · Last active 28 Oct 2026

MFA coverage

MFA figures cover the 7 people in your dark-web export, not your whole directory. The tenant-wide gap is the missing policy.

5

No MFA

1

MFA only

1

Passwordless

Admins in your export: 1. Without MFA: none.

Without MFA: Liam Thompson, Markus Schneider, Michael Johnson, Takeshi Yamamoto, Lucas Silva.

  • High. Phishing-resistant MFA shall be enforced for all users
  • High. Tenant shall have baseline policy for MFA for all users and applications
  • High. Legacy authentication shall be blocked
  • Medium. Tenant should have phishing resistant authentication requirement targeting recommended admin roles in Conditional Access

Forgotten objects

  • Dormant AD members, no hybrid activity25
  • Accounts that never logged in27
  • Dormant accounts1
  • Dormant devices2

Separate checks. Do not add them into one headcount.

Named and dormant in your dark-web export: Chinedu Okafor.

  • Sophos Central IntegrationConnector · High · 9

    Application shall not use client secrets for authentication when privileged permissions are present

  • Sophos EmailConnector · High · 5

    Application shall not use client secrets for authentication when privileged permissions are present

  • Sophos ZTNAConnector · High · 5

    Application shall not use client secrets for authentication when privileged permissions are present

  • Sophos XDR - Security alertsConnector · Medium · 4

    Application shall not use client secrets for authentication

  • Rubrik Exchange - sophos-clearstoneConnector · Medium · 3

    Applications with mail-related or privileged access permissions

Dark web, by person

7 people, 10 records. 5 with a plaintext password, 2 hash only. 6 accounts look active, 1 dormant. No password here was changed after the breach date.

  • Liam Thompson

    Plaintext, still in use

    Plaintext · paidwork.com · 30 Jul 2026 · No MFA

  • Markus Schneider

    Plaintext, still in use

    Plaintext · go-bus.com · 30 Jul 2026 Hash · go-bus.com · 30 Jul 2026 · No MFA

  • Michael Johnson

    Plaintext, still in use

    Plaintext · fluke.com · 30 Jul 2026 · No MFA

  • Takeshi Yamamoto

    Plaintext, still in use

    Plaintext · fluke.com · 30 Jul 2026 Hash · forum.kodi.tv · 30 Jul 2026 · No MFA

  • Sean O'Brien

    Hash only · admin

    Hash · fluke.com · 30 Jul 2026 · Admin · Phishing-resistant MFA

  • Chinedu Okafor

    Plaintext, dormant account

    Plaintext · paidwork.com · 30 Jul 2026 Hash · paidwork.com · 30 Jul 2026 · MFA, not phishing-resistant

  • Lucas Silva

    Hash only

    Hash · go-bus.com · 30 Jul 2026 · No MFA

Sources: fluke.com (30 Jul 2026, 3); paidwork.com (30 Jul 2026, 2); go-bus.com (30 Jul 2026, 2); forum.kodi.tv (30 Jul 2026, 1).

Progress over time

64 findings closed, 17 of them high. 1 dismissed. Open risk weight went from 19 to 29, up 56%. The clean-up was real. New findings replaced it.

Feb 26

Mar 26

Apr 26

May 26

Jun 26

Jul 26

Aug 26

Sep 26

Oct 26

Ink is opened. Blue is closed. Owner is not a column in your export.

Action plan

Prioritized from what is still open. Fix it where the control actually lives.

  1. 01

    Reset the live leaked passwords and revoke sessions

    Liam Thompson, Markus Schneider, Michael Johnson, Takeshi Yamamoto are active, with a plaintext password found on the dark web and no MFA. The directory password was not changed after the breach date.

    Where: The account in Microsoft Entra or Active Directory. Revoke sessions after the reset. Who: A User Administrator, with the person who owns the account. License: Included with the directory. ITDR can force the reset while it stays deployed.

  2. 02

    Require phishing-resistant MFA and block legacy sign-in

    The tenant does not enforce phishing-resistant MFA for everyone, and related authentication gaps are still open. A leaked password is enough wherever MFA is optional.

    Where: Microsoft Entra admin center → Conditional Access. Who: Conditional Access Administrator. License: Microsoft Entra ID P1 for Conditional Access. Entra ID P2 only if you also block on sign-in risk.

  3. 03

    Turn lockout on and lengthen domain passwords

    Domain policy still allows a short password, an empty lockout, or both, and cloud password protection is not fully enforced. That is what makes a dark-web password reusable.

    Where: Default Domain Policy in Group Policy, and Entra password protection. Who: Domain Admin for the policy. Authentication Policy Administrator for Entra. License: The domain policy needs no extra Microsoft license. A custom banned-password list needs Entra ID P1.

  4. 04

    Take standing privilege out of everyday accounts

    Administrator sits in a well-known admin group. Empty Schema Admins except during a schema change. Do not delete the built-in Administrator (RID 500). Deny it interactive logon and alert on any use.

    Where: Active Directory Users and Computers, on the privileged groups. Who: Domain Admin. License: Included with Active Directory.

  5. 05

    Replace privileged app secrets and cut unused rights

    Sophos Central Integration, Sophos Email, Sophos ZTNA still carry broad rights or a client secret. Security-tool connectors are not exempt. Prefer a certificate, and drop any Graph permission the app does not use.

    Where: Entra admin center → Enterprise applications and App registrations. Who: Cloud Application Administrator. License: Included with the tenant.

  6. 06

    Disable what nobody is using

    25 dormant AD members, 27 never signed in, 2 dormant devices. Named in the dark-web export: Chinedu Okafor. Counts come from separate checks and can overlap. Disable first, then delete on a schedule.

    Where: Microsoft Entra and Active Directory. Who: The identity administrator. License: Included. ITDR rechecks dormant objects about every two hours, so this does not go stale.

Why this should outlive the trial

A trial is about 30 days. Entra and Active Directory drift the day after. ITDR reruns posture checks about every two hours and dark-web checks about every 15 minutes.

More than 160 checks cover human and non-human identities, with detection mapped to MITRE ATT&CK Credential Access. The risk score moves daily as findings open and close.

The point is the response, not another spreadsheet. Reset the password, revoke the session, lock the account. With Sophos MDR, identity detections can go to an analyst.

67% of attacks trace back to a compromised identity. Sophos Active Adversary Report 2026. Product detail: sophos.com/ITDR.