Solutions and services · Cyber security

Identity and privileged access protection

Identity protection secures accounts, passwords and access before anyone misuses them — today it is the most common attack path into the corporate environment.

We protect Active Directory, privileged and service accounts as well as supplier access, and that without agents and without interfering with the protected systems — so the protection also fits legacy and OT environments. We build on the platform Silverfort, where we Silver Partner, and on experience from running environments that we design and operate ourselves.

Why Active Directory is the most frequent target of attacks

Active Directory controls sign-in and permissions in almost every organisation. So a single misused identity is enough for an attacker — a stolen password, a forgotten service account, a former supplier's access — and they gain a route to the systems, the data and the backups. Most incidents do not begin with "breaking through" the infrastructure, but with signing in through a legitimate-looking account.

What typical weak points have in common is that nobody in the organisation knows about them — not that someone underestimated them.

Unregistered privileged accountsNobody knows how many of them there are in the environment. An account left behind by a former administrator or by a supplier stays functional for years and nobody misses it.
Service accounts whose passwords are not changedChanging the password would break the process the account serves — so it is not done. Yet the account often has higher privileges than any user.
MFA everywhere that management of privileged sign-ins is missingOlder applications, the command line and local sign-in to Windows too — and OT environments are often without MFA.
No overview of sign-insWithout a record of authentications, an attacker's movement across the network cannot be told apart from an administrator's ordinary work.

How Qintec approaches identity protection

We proceed from an overview to measures — in that order, because without an inventory you cannot say what is really critical in the environment. The technological basis is the platform Silverfort: it is deployed without agents and without changes to the protected systems, so it also fits older and OT environments.

Assessment of the current stateA stocktake of identities, privileged accounts and service accounts in the environment. The output is an overview of risks and a proposal of measures with priorities — not a software quote.
Second factor for critical accessMFA where it is missing: privileged sign-ins, admin tools, remote access and systems that do not support it natively.
Service accounts and suppliersManagement of accounts and their protection in everyday use, and setting the boundary of what is permitted — without changing passwords and without interfering with automation.

The Silverfort platform

The solution is built on the platform Silverfort — a single identity security layer for the whole hybrid environment: people, machines and AI agents. At its core is the patented architecture Runtime Access Protection: the platform integrates directly into the identity infrastructure and sees and evaluates in real time all authentications in Active Directory — Kerberos, NTLM and LDAP.

Deployed with no agents and no proxy, without changes to servers and applications and without replacing Active Directory itself. That is precisely why it can be used where other solutions stop — on legacy and in-house applications and in OT environments.

Silverfort Silver Partner

Qintec is a Silverfort Silver Partner. We supply, deploy and operate the platform as the manufacturer's partner — including the design, verification in pilot operation and connection to our monitoring.

Silverfort multi-factor authentication — a confirmation prompt on a mobile next to a laptop

Why the decision is made at authentication and not later at detection

A model that attacks does not take breaks. Anthropic on its advice Claude Mythos states that it has "the strongest cybersecurity capabilities of any model in the world"; unrestricted access to it is reserved for partners in the Glasswing programme. An attack run with such a tool will be over faster than any procedure based on first recording an incident, then evaluating it and only then dealing with it can keep up.

That is why access is decided at the moment of sign-in — before access is granted. It is not detection, but a decision in the path.

Illustration from the manufacturer: Silverfort has published a case study from a controlled red-team exercise in which Mythos was deployed as an autonomous attacker in a large enterprise environment. According to Silverfort it achieved full domain compromise in approximately two hours, and the most effective measure was a virtual boundary around service accounts. This is an exercise, not a real incident, and it is vendor material — Anthropic has not commented on it and did not take part in the exercise.

Silverfort case study · Anthropic notice

Platform modules we deploy:

Universal MFAA second factor even where it could not be deployed until now: legacy and in-house applications, admin tools and the command line, local Windows sign-in, file servers and databases, VPN, RDP and SSH, VDI and OT infrastructure. Whether a second factor is requested is decided by static rules together with risk signals — user, device, behaviour, target system.
Authentication FirewallLeast-privilege policies enforced in real time during authentication: a risky attempt is challenged for verification or denied. This applies to every resource, protocol and access path in Active Directory, including local Windows accounts.
NHI SecurityProtection of non-human identities. It automatically finds every service account in the environment, determines its type, level of privilege and status, builds a profile of normal behaviour and around it a virtual boundary — when there is a deviation it blocks access or raises an alert. Without changing passwords, so the processes the account serves are not interrupted.
Privileged Access SecurityPrivileged access without a vault: accounts are continuously classified according to actual authentication activity — including service accounts, shadow admins and identities created by AI — and least-privilege and just-in-time (JIT) access policies are enforced directly at sign-in.
ITDRReal-time detection of attacks on identities: Pass-the-Hash, Pass-the-Ticket, Kerberoasting, DCSync, privilege escalation and lateral movement across the network, which ransomware also uses to spread. The response sits directly in the flow: denial, a challenge for verification or termination of the session before authentication completes.
ISPMContinuous analysis of the state of identities and tracking of deviations: faulty configurations, old protocols such as NTLMv1 or weak LDAP, shadow admin accounts, inactive and orphaned identities — across the on-premise environment, the cloud and AI agents.
Identity GraphA live map of identities, their permissions, attributes and the relationships between them. It answers the question of what really sits behind a single account.
Access IntelligenceThe view from the other side — of a specific system: who actually accesses it, not who could access it according to their permissions.
AI Agent SecurityDiscovery and monitoring of AI agents, including enforcing the lowest necessary privilege at runtime — from the directory's point of view an agent is an identity too.

Why this fits the environments we work in: industrial and legacy systems that cannot take an agent or a change to their code; the public sector built on Active Directory; and smaller IT teams that do not have the capacity for a multi-year project. Design, verification in pilot operation, deployment and connection to monitoring and P1–P4 support we will take care of.

How we can evidence it

Security claims are hard to verify from the outside, so we state only what we can evidence with a document or a completed project.

Certification

ISO/IEC 27001:2022

Information security management system. Registration number ISMS0651125/2, issued on 13 April 2026 by the certification body CERTICOM (SNAS, reg. no. 796/R-153), valid until 31 October 2028.

Verification in operation

Government Office of the Slovak Republic — proof of concept

We verified the solution for identity protection and privileged access in pilot operation. It was part of a collaboration in which we supplied an HPE Alletra disk array and a Proxmox VE virtualisation node.

Reference detail →

Partnership

Silverfort Silver Partner

The platform on which we build identity protection is supplied by us as the manufacturer's partner — not as someone taking over another party's implementation.

The infrastructure that identity protection applies to is also infrastructure we design and operate ourselves — from virtualisation and backup in monitoring. We therefore design measures with regard to what actually runs in the environment.

Frequently asked questions about identity protection

What technology is the solution built on?
On the platform Silverfort — a single identity security layer that captures authentication flows directly at the Active Directory level. Deployment is agentless and requires no changes to servers or applications, so it also covers older systems, admin tools and OT environments where conventional MFA cannot be deployed.
Do we have to change or migrate Active Directory because of it?
No. The platform layers on top of the existing identity infrastructure and evaluates the authentications in it — with no agents, no proxy and no replacement of Active Directory itself.
Do we have to change the passwords of service accounts?
No. Service accounts are protected by a boundary of permitted behaviour, not by changing the password — precisely so that the processes those accounts serve are not interrupted. The platform first finds the accounts itself and builds a profile of their normal activity.
Will the deployment bring operations to a halt on day one?
No, provided it is started gradually. For service accounts, a deviation can at first only be reported, with blocking switched on once the behaviour profile has been verified. We determine the scope and the order according to what is running in the environment.
Do we need a conventional PAM with a vault for privileged accounts?
You do not have to. Privileged access can be managed without a vault as well — accounts are classified according to their actual authentication activity and the permission is enforced at sign-in itself, including access granted only for a limited time.
What is identity protection and why does a company need it?
Identity protection means securing user and service accounts, passwords and access so that an attacker cannot misuse them. Most successful attacks today do not begin by breaking into a system, but by misusing a stolen or poorly protected identity.
Why is Active Directory the most common target of attacks?
Active Directory controls sign-in and permissions across the whole organisation. If an attacker takes control of a privileged account in AD, they gain access to all systems at once. That is why AD is protected as a priority — through stocktaking of accounts, MFA and monitoring of privileged access.
What is privileged access and PAM?
Privileged access is an account with extended permissions — administrators, service accounts, suppliers. PAM (Privileged Access Management) registers, restricts and monitors these accounts so that they cannot be quietly misused.
How does the initial consultation work?
We start by assessing the current state of identities and privileged access in your environment. The output is an overview of the risks and a proposal of measures with priorities. The scope and the claims of specific technologies will be specified according to your environment.
Do you have information security certification?
Yes, Qintec holds the ISO/IEC 27001:2022 certificate (ISMS0651125/2) for its information security management system, valid until 31. 10. 2028.

Related services

AI on your own infrastructureSensitive data and AI on your own infrastructure — the security of the environment is fundamental. Monitoring and technical supportMonitoring of the environment and support with P1–P4 priorities. Identity and access managementWho has which rights in the system: single sign-on, rights by role and the account lifecycle.

Cyber security · Consultation

Check the risks in your AD.

Consultation on identity protection and privileged access — assessment of the current state and a proposal of measures for your environment.

Discuss identity protection Contact and quotation

E-mail: qintec@qintec.sk · Phone: +421 2 3240 1217 (working days 9:00 – 15:30)