Skip to Main Content
October 22, 2026

Trimarc, 18 Months Later at TrustedSec

Written by Sean Metcalf
Active Directory Security Review

It’s been over a year since Trimarc merged into TrustedSec. This move builds on two recognizable brands in the industry and brings Trimarc's deep knowledge of Microsoft identity security into TrustedSec's existing suite of services. I always said that I would run Trimarc as long as I was having fun. Unfortunately, I ended up running a business instead of doing the fun things I enjoy. Some of the enjoyable things for me include performing research, writing articles, updating services, posting on ADSecurity.org, interacting on social media, conference talks, etc. Now, I get to do those things again!

Bringing Trimarc to any company poses some concern about how the blend will occur and the potential issues that could arise. I spoke with Dave Kennedy about my concerns, and we were able to work out some things that could go awry. Thankfully, TrustedSec welcomed the Trimarc team with open arms and the transition was smooth. Sure, there were some bumps in the initial months during the transition, but these were smoothed out along the way, and we still successfully performed assessments. The important thing is that customers continue to want the Trimarc security assessments and that's what we deliver at TrustedSec now.

The great thing is that we get to continue what we started at Trimarc. Several of the team members transitioned over as TrustedSec employees and are performing security assessments as they have for years. The reports have a different name but keep the same content. We have kept the "fix the stuff attackers actually use" mindset. Both of our primary security assessments, the Active Directory Security Assessment (ADSA) and the Microsoft Cloud Security Assessment (MCSA, now M365 assessment), are part of the TrustedSec service portfolio and are as popular as ever!  

In addition to the ADSA & M365 assessments, there are other services available to customers, including remediation of recommendations from these and other assessments. These services continue to be updated to stay current with security trends and research. By bringing Trimarc to TrustedSec, Trimarc customers can now leverage TrustedSec as their "one-stop shop" of cybersecurity services ranging from penetration testing and Red Teaming to incident response and compliance services.

We continue to see the same sort of security issues in Active Directory and Entra ID as we have in the past. The Active Directory issues include:

  • Admin & service accounts with old passwords
  • KRBTGT account with an old password
  • Default domain administrator account with a Kerberos service principal name (SPN)
  • Accounts in privileged groups that don't belong or need to be there
  • Group Policy permission issues
  • Improper Kerberos delegation
  • Active Directory Certificate Services (AD CS) security issues - run Locksmith2!

The Entra ID issues include:

  • Insecure user defaults
  • Insecure guest defaults
  • Not leveraging PIM fully for eligible, not active members
  • Members in Tier 0 roles that don't belong
  • Admins aren't required to MFA at every logon
  • Teams/SharePoint/OneDrive sharing settings

Here at TrustedSec, my title is now Identity Security Architect, and my primary role is to focus on security research. I’m involved in some of the more complex customer Microsoft identity challenges. Part of my role is helping to update and improve the identity services. I also help identify and curate new potential services that are emerging due to market forces. This includes the new TrustedSec service offering around Microsoft Copilot, which involves checking to ensure organizations are prepared to deploy Copilot in their environment. I hosted a webinar with Managing Director of Remediation Services Paul Sems to discuss the challenges when it comes to introducing Copilot into an environment.

Another important part of my role is sharing information with the community through blog posts, social media posts, and conference talks. Since joining TrustedSec, I have spoken at several conferences, including RSAC (twice!), about Entra ID security attack and defense.

Here are some things that I have been busy with in the past year+:

Having integrated the Trimarc assessments with TrustedSec, the Trimarc team has been busy with security assessments and remediation efforts. If you are interested in having us perform a proactive security assessment, help with remediation, or any number of TrustedSec services, please get in touch with us!

Related Links