In what can only be described as a heroic attempt to stop enterprises from tripping over their own passwords, ManageEngine has announced shiny new features for its identity and access management platform, AD360.

The updates include identity risk exposure management and multifactor authentication for local users — because apparently, leaving accounts unprotected in 2025 is still a thing.

According to the 2025 Verizon Data Breach Investigations Report, 22 percent of breaches started with credential abuse, which seems to confirm that cyber attackers still rely on companies being perpetually careless.

In an era where “123456” somehow remains a popular password, AD360’s latest update offers graph-based attack path analysis to help security teams visualize how hackers might waltz through Active Directory like it’s an open bar.

Using identity risk exposure management, AD360 now lets enterprises detect multi-step lateral movement and privilege escalation paths — a helpful feature if you like finding digital landmines before they go off.

Local user MFA is also being rolled out for accounts on non-domain-joined servers, DMZs, and test environments — because unmanaged local accounts have somehow survived like digital cockroaches in corporate environments.

“With this release, ManageEngine AD360 moves beyond traditional IAM by embedding identity threat defenses into core identity operations,” said Manikandan Thangaraj, ManageEngine’s vice president, implying that traditional IAM tools are the equivalent of seat belts on a motorcycle.

The tool also features machine learning-driven access recommendations during provisioning and review campaigns, since human judgment clearly hasn’t worked out well so far.

As cyberattacks become more sophisticated, the patchwork of duct tape and hope most companies use to manage identities is no longer enough, prompting vendors like ManageEngine to insert real-time threat analysis directly into IAM platforms.

The updated AD360 also includes enhancements to its access certification module, offering broader entitlement visibility and improved identity risk indicators across Active Directory and Microsoft 365 environments.

This could help enterprises meet security standards such as NIST SP 800-207 on Zero Trust architecture and PCI DSS 4.0 Requirement 8 — assuming, of course, someone actually reads them.

ManageEngine claims these upgrades help transform IAM from a glorified gatekeeper into a frontline security guard, which sounds nice on paper, even if most enterprises still treat identity management like a forgotten side quest.

The hope is that by embedding security deeper into everyday access operations, organizations will finally take identity threats seriously — or at least seriously enough to stop using the CEO’s dog’s name as a login credential.

AD360 aims to unify identity infrastructure with features like lifecycle management, adaptive MFA, secure SSO, auditing, and compliance monitoring, all wrapped in a supposedly intuitive console.

With out-of-the-box integrations and customizable connectors, AD360 plays nice with existing IT ecosystems — though whether those ecosystems are remotely secure is another story entirely.

The platform is currently used across sectors like healthcare, finance, education, and government — industries where a compromised identity doesn’t just mean leaked emails, but regulatory nightmares and media frenzies.

ManageEngine, a division of Zoho Corporation, seems determined to lead the charge against lazy identity practices, hoping to convince organizations that good security hygiene is more than just a checkbox during audits.

Whether these new features will finally force companies to act before the next headline-grabbing breach remains to be seen, but at least AD360 is trying to make it harder for them to fail.

In the end, if enterprises still can’t manage to secure local accounts in 2025, maybe the attackers deserve the win.