Modern cyber attacks rarely begin with malware anymore, they begin with identity. This story follows a real-world inspired cyber security audit where hidden Active Directory risks, legacy authentication exposure, and operational blind spots were uncovered.