Ignite 2018: There are no compensating controls for an insecure Active Directory