A password passed in the clear is not the only way to lose a network.
The Kerberos protocol was built to prevent exactly that. Secure, ticket-based authentication. Mutual trust. Encrypted exchanges. Yet, time and again, we see data breach reports where the attacker didn’t break Kerberos—they abused it. Misconfigurations, stolen keys, golden tickets, and service account compromises open the door. Once inside, attackers move laterally until every credential is theirs.
A Kerberos data breach is never about one point of failure. It’s the chain. Weak password policies on service accounts. Old DES or RC4 encryption types still enabled. Privileged accounts not rotated in years. Domain controllers left unpatched. All of this gives attackers time, and Kerberos gives attackers one unchanging truth: if they get the key, they own the kingdom.
Incident forensics from recent breaches show the pattern. Dump the memory from a domain controller to extract the KRBTGT account hash. Forge golden tickets to impersonate any user. Create silver tickets for persistence without touching the DC again. Expand into shadow IT systems not hardened for enterprise defense. By the time alerts trigger, the compromise is already systemic.