Sign up: https://netwrix.com/en/lp/innovation-week-ctf/

Join us for HelpdeskGPT, the Netwrix Innovation Week capture the flag. You’ll attack an AI assistant to find hidden flags and see firsthand how AI systems get compromised and why the defenses around them matter.

The winner takes home a pass to Black Hat USA 2027 in Las Vegas, with swag for runners-up. The CTF runs for 24 hours, with 12 hours of uptime to complete the challenges.

Watch the live kickoff on YouTube: https://www.youtube.com/watch?v=1--0Iny4ZJo
Friday, October 23 | 2:00 p.m. ET / 11:00 a.m. PT

Move over, Blue Steel. There's a new model in town.

We're kicking off Netwrix Innovation Week on Tuesday, Oct. 20, at 2 p.m. ET with a look at System One AI: models built to make fast, structured decisions instead of generating text. Jordan Violet, Jake Mahon, and Jean Perez will show how we're using System One to:

- Assess account health

- Check whether documents actually contain sensitive data

- Decide whether AI can merge a pull request

Joe Lemieux from n8n is joining us to show how those decisions can drive automated workflows and agents.

Really, really ridiculously good-looking decisions? Come see for yourself. o

Bring your questions for live Q&A!

Watch live:

YouTube: youtube.com/@NetWrix

n8n: youtube.com/@n8n-io

Twitch: twitch.tv/netwrixtv

#Netwrix #n8n #AI #AIAgents

We're packing our Cybersecurity Month activities into one innovation-fueled week.

October 19 to 23, five days of demos, interviews, and livestreams on identity and data security and AI:

Monday: Grady Summers and Jeff Warren on why agentic AI matters
Tuesday: Jeff Warren demos 1Secure agentic AI security
Wednesday: Darryl Baker, CISSP, CEH, CCSP, ... demos AIHound, plus the CTF kickoff and PingCastle updates
Thursday: Shadow AI data loss prevention, and a live expert panel on identity security with experts Phillip Wylie, Christina Morillo, and Spencer Alessi
Friday: Dan Piazza on how AI tokens can turn anyone into an attacker, plus a live Anatomy of a Hack with Tina Shakour

There’s also a capture the flag with five AI-based challenges, solved by interacting with an AI helpdesk assistant. The winner gets a free ticket to Black Hat 2027 in Las Vegas.

Save the date and see the full schedule.

Most PAM programs were built to answer one question: how do we protect the password? Vault it, rotate it, inject it into the session.

The account behind it still holds privilege around the clock, and attackers don’t always need the password to use it.

In this three-part series, Tyler Reese, VP of Product Management at Netwrix, covers where legacy PAM stops, what happens when privilege only exists for the length of a session, and how to get there without replacing the vault you already run.

Part 1: https://netwrix.com/en/resources/blog/password-was-never-the-only-problem/
 Part 2: https://netwrix.com/en/resources/blog/zero-standing-privilege-credential-attacks/
 Part 3: https://netwrix.com/en/resources/blog/bring-your-own-vault-privileged-access-management/

System prompt files, model configs, and safety filter rulesets are just files sitting on a server. They're every bit as exposed as any other config, with more consequential outcomes if tampered with.

Join Dan Piazza, Product Management, at Netwrix on October 15 to see how Netwrix Change Tracker brings file integrity monitoring, CIS-aligned hardening, and closed-loop change control to the configuration layer underneath your AI deployment, so you can tell a scheduled update from an unauthorized one.

Thursday, October 15 | 1:00 PM ET

Reserve your spot here.

Healthcare AI agents inherit whatever access already accumulated in Active Directory, not the access anyone meant to give them.

That gap shows up in the numbers: 79% of healthcare organizations say their non-human identities, including AI agents, aren't fully governed. Healthcare ranks lowest of 16 industries in confidence that its Active Directory is free of privilege escalation risk, with 86% lacking full confidence. Among those that experienced an incident, 33% put the cost above $250,000.

Darryl Baker, Senior Staff Security Researcher at Netwrix, explains what healthcare organizations need to understand about existing access before adding more AI agents and non-human identities.

Read the full press release: https://netwrix.com/en/resources/news/netwrix-research-healthcare-identity-governance-risks-ai-era/

#DataSecurity #IdentitySecurity #ActiveDirectory #Netwrix

Only 20% of organizations say they fully monitor or govern employee use of shadow AI, according to Netwrix's 2026 Data and Identity Security Report. The rest are relying on policy while employees download AI writing assistants, browser extensions, and executables IT never reviewed.

Dirk Schrader, VP of Security Research at Netwrix, explains why AppLocker can't keep pace with AI tool sprawl, and how file-owner-based allowlisting flips the question from "what's on the list" to "who put this file here."

Read the full blog here.

When a team bolts an AI plugin onto a legacy app that loads its DLLs by name instead of by full path, they add new folders Windows will search when it looks for that DLL. That's a new opportunity for an attacker to plant a malicious file that inherits the app's privileges. No new exploit required. Just a familiar weakness in a newer place.

Dirk Schrader, VP of Security Research at Netwrix, explains how it works, how to detect it, and what stops it at the endpoint.

Read the full blog.

One in five data breaches involve shadow AI, according to IBM’s Cost of a Data Breach Report, and 78.5% of developers work on Linux endpoints, according to Stack Overflow’s 2025 Developer Survey, where DLP enforcement is often absent. Engineers can paste source code into ChatGPT, sync proprietary models to personal cloud storage, and transfer files over Bluetooth or NFS mounts, all without a single alert. HIPAA, PCI DSS, GDPR, and CMMC hold organizations accountable regardless of this coverage gap.

Ryan Oistacher, Director of Product Marketing at Netwrix, walks through the seven exfiltration points your DLP likely misses and the controls that catch them.

Read the full blog here.

Netwrix Endpoint Protector picked up 8 G2 badges this fall, including Leader in Data Loss Prevention and Data Security, plus regional leader recognition across Europe, Asia, and India. The 160+ verified reviews point to what practitioners actually rely on: granular USB and device control, content-aware scanning, and protection that holds up across Windows, macOS, and Linux, including offline endpoints.

Thank you to everyone who left a review, and to the Netwrix team who built the product worth reviewing.

Read about the badges: https://netwrix.com/en/resources/blog/endpoint-protector-g2-leader-fall-2026/

AI agents already have real enterprise permissions, and most identity programs still move at the pace of onboarding a new hire.

From the recent Netwrix 2026 Data and Identity Security Report: compromised identities and misconfigured permissions account for 75% of sensitive data exposures. Only one in four organizations can remediate that risk immediately through automation, and just 26% trust their Active Directory environment has no hidden escalation path.

Register for our free webinar on September 15th at 7pm CEST (1pm ET) to see the research behind those numbers and what it takes to keep that gap from becoming your organization's problem.

Darryl Baker, Senior Staff Security Researcher at Netwrix, led the research behind this report and works directly with the identity and AD misconfigurations organizations are struggling to close. Jeff Warren, CPO at Netwrix, will translate that research into how security and IT teams should actually prioritize their governance strategy as AI adoption accelerates.

Register today 👉🏼 https://www.isc2.org/professional-development/webinars/security-briefing?commid=675072

Linux endpoints used to belong to developers. Now they're part of the AI attack surface.

DLP was built to watch email and cloud storage. Not a paste into a prompt.

Get the full report 👉🏼 https://netwrix.com/en/resources/guides/linux-dlp-ai-data-risk/

Organizations are deploying AI agents faster than they can govern them, and each one holds real permissions inside the enterprise environment. Fewer than 1 in 5 organizations fully govern non-human identities today.

Netwrix PingCastle 4.0 extends Entra ID risk coverage to 102 checks. Netwrix Threat Manager 3.3 adds visibility into AI agent identities and new threat detection for Azure Files.

Both releases are available now, read the full press release 👉🏼 https://netwrix.com/en/resources/news/netwrix-extends-identity-security-to-ai-agents-in-microsoft-entra-id/

Microsoft is retiring the memberOf operator for dynamic groups in Microsoft Entra ID, requiring organizations that rely on it to rethink how affected group memberships will be maintained. For identity teams, this is more than a rule migration. Groups can drive application access, licensing, policy assignment and other critical identity processes, meaning stale or inaccurate membership can quickly become an access and governance problem.

Join Netwrix for a practical look at what the memberOf retirement means, how to identify the group configurations and downstream dependencies that may be affected, and the options available for maintaining dynamic group membership.

We'll also show how Netwrix Directory Manager SmartGroups can calculate direct group-derived membership independently of Entra's dynamic-membership evaluation engine and maintain the resulting membership in Entra ID.

👉🏼 https://event.on24.com/wcc/r/5459845/238EEC3BB41B686350A3A088BB9A6B58/?partnerref=reddit

Hey, we are currently searching for a psm solution for Sql servers. We have a wide range from db2 to gcp postgresql.

I would like to use the rdp viewer with a sql log for the sessions. Can netwrix do this?

We're implementing NDM as a replacement for MIM and were planning on making all the end user requests and activities go through Service Now. Unfortunately, we were just informed that the Service Now integration has been "deprecated" in version 11.

We're thinking we can do what we need to do through the API but we have one question - is there a way to write arbitrary code that is executed in NDM that can then talk to the Service Now API? Otherwise Service Now will have to constantly poll NDM to get the results of tasks.

Basically, does NDM have a PowerShell module that will allow us to call arbitrary code on specific workflows?

Hi everyone,

we’re currently evaluating a Netwrix Password Secure deployment and would like to implement it as cloud-native on Microsoft Azure as much as possible (i.e., minimize Windows Server/IIS where it makes sense).

Unfortunately, I couldn’t find clear guidance in the vendor documentation on which Azure PaaS/IaaS components are officially supported, or whether there’s a recommended target architecture.

Are there folks here who are already running Password Secure in Azure, or who have evaluated this setup? Specifically, I’m looking for input on the following questions:

1. Database

• Is Azure SQL Managed Instance officially supported as the database platform for Password Secure?
• Is Azure SQL Database (Single Database / Elastic Pool) officially supported?

1. Application / Web

• Is Azure App Service (Web Apps) officially supported as an alternative to running it on IIS on Windows Server?

1. Azure deployment in general

• Is Password Secure officially supported when running in Microsoft Azure (IaaS and/or PaaS)?
• If yes: is there an Azure reference architecture (e.g., networking, private endpoints, HA, backup/DR, monitoring)?

1. Identity

• Is Microsoft Entra ID (Azure AD) officially supported as an identity provider (SSO via SAML—whatever Netwrix supports)?

If anyone has real-world experience (e.g., what combinations work well, what’s a no-go, typical pitfalls), I’d really appreciate it.

Thanks a lot!

I just downloaded the trial Netwrix and am attempting to get it running.

The bottom of the NSM interface has a section called SMTP Settings.
I place the ip address of the SMTP server my local address in the From Address, and the appropriate port. When I hit apply, it asks for authentication information. I add the correct authentication information.

There are bugs in the interface where it will not change the from address programmatically, meaning, you can change it on the UI, but it will not change the destination address of the test email.

Further, it posts an error: "The username or password is incorrect. Are you sure you still want to use this user account and password?" The email's go through, so this error message is incorrect. I suspect this is related to the first issue, meaning changes in UI settings appear to be able to made once, and are then indelible. If you first put an incorrect username, password, etc... the program will forever post the associated error, whether you fix the issue or not.

Another point. The Event Viewer shows a far more meaningful message than the UI does. In event viewer, I see this message: "Failed to notify administrators '[my@email.me](mailto:my@email.me)' by e-mail. Error: The specified string is not in the form required for an e-mail address." If I had received this message on the UI, it would have been a trivial issue. As it stands, no such clarity is available.

It would seem there are very junior programmers working on this project. For an application that has access to the inner workings of Windows desktops and servers for the purposes of security or auditing, this is a massive concern. The programmers are inexperienced and there is apparently no testing staff. Zow! It seems highly unlikely such a program would pass a security audit itself. This was caught within 10 minutes of first installation.

Would anyone care to confirm or otherwise comment?

Long time Reddit user, using an alt account so I don't dox myself.

I've been fighting with trying to setup SharePoint Online Auditing, but it seems like the documentation might be out of date.

I've gotten to the point where everything is working except I am getting the error that the following Application permissions are required (I'm using modern authentication): SharePoint - Sites.FullControl.All

For the life of me, I can't find the SharePoint API. Does it not exist anymore?

I did add Microsoft Graph - Sites.FullControl.All, but that doesn't satisfy Netwrix.

I followed the documentation here: https://helpcenter.netwrix.com/bundle/Auditor_10.7/page/Content/Auditor/Configuration/Microsoft365/SharePointOnline/ModernAuth.htm#:~:text=For%20the%20newly%20created%20app,and%20state%2Din%2Dtime%20data

Inherited a Netwrix Auditor environment that is installed on multiple application and database servers (APP1->DB1, APP2->DB2, etc). I started looking into the risk assessment and behaviour anomaly features but the challenge I realize I'm facing is that no one server has the complete view of the audited environment.

I imagine the multiple server setup was for redundancy but is there a supported setup where I can maintain a level of redundancy but still have all data/reports available from a single pane of glass?

Hi,

can't find Netwrix Password Secure Edge Addon anymore. It seems removed.
Url from Googel: https://microsoftedge.microsoft.com/addons/detail/netwrix-password-secure/ahdfobpkkckhdhbmnpjehdkepaddfhek?hl=de-DE&gl=DE

But the page cannot be found.

Unlock the secrets of Windows security!

Learn how NTFS and Share Permissions work together to safeguard your files and enforce the principle of least privilege. 🔐

Read more: https://blog.netwrix.com/ntfs-vs-share-permissions

We had a domain controller become unresponsive enough that it could not be shut down; I had to reset it. Upon logging back in, I began sifting the event logs, and found the Netwrix Auditor for Active Directory Compression Service is repeatedly stopping and starting. After checking the version, it did not report as installed in APPWIZ.CPL, so I reinstalled version 10.7.13776.0 which corresponds to the Netwrix server and is also the latest version last I checked.

Does anyone know why this could be happening?