Today attackers often need only a single account. Active Directory remains one of the biggest corporate security problems

Modern cyber attacks today often don't start with sophisticated malware or zero-day vulnerabilities. According to Jan Marek from Cyber Rangers, attackers many times only need an ordinary user account, a weak password, or historical chaos in Active Directory.

In the new episode of the CZECH CYBER TV Podcast we talked about the reality of red teaming, the most common mistakes in corporate environments, and why identities remain one of the weakest points in today's security.

"Once someone gets an ordinary account and can poke around Active Directory, there's a good chance they'll find some misconfiguration that can lead to total dominance of the entire domain."

Active Directory, he says, remains an extremely attractive target for attackers. Companies still have old service accounts, excessive privileges, unmaintained "mess" in their infrastructure, or passwords that can be cracked within minutes using password spraying.

The podcast also included a number of concrete examples from practice. From situations where users had everyone full control over critical parts of the domain, to cases where administrators used the same password across privileged accounts.

A major topic was also AI and its impact on cybersecurity. It wasn't the classic scaremongering about "AI hackers." The discussion focused mainly on how artificial intelligence dramatically speeds up OSINT, system analysis, vulnerability discovery, and attack automation. At the same time, Jan Marek says a new problem is emerging — security teams are becoming overwhelmed by a huge amount of findings that need to be verified and addressed.

The conversation also touched on the CYB3R DAYS 2026 conference, which Cyber Rangers are organizing on September 2–3 at Kongresovém centru Praha. Honza describes why they try to build the conference mainly around technical and practical content without marketing sales pitches and why, in his view, the Czech market has long lacked a space for openly sharing real experiences from security practice.

🎫 More about the CYB3R DAYS 2026 conference and tickets: https://www.cyb3r-days.com

In the premium part of the interview with Jan Marek we go much deeper into the reality of modern attacks, EDR bypasses, and real incident response scenarios. We talk about cases where attackers were operating directly on domain controllers while security technologies still reported "No Threats Detected."

The premium 40 minutes of the interview are available to CCTV+ subscribers.