About Darryl Baker

Darryl Baker is the CISO of Menrva Technologies and an identity and access management security researcher who studies how attackers abuse Active Directory, Entra ID, and the authentication protocols that hold them together: Kerberos, NTLM, and OAuth. Online he goes by dfirdeferred.

Menrva brings cybersecurity education, community outreach, and hands-on tech support to nonprofits and small businesses. These are organizations that are often targeted but rarely have a security team of their own, and Menrva helps them protect themselves and teaches their people the skills to stay safe.

Before security, Darryl spent 10 years in the U.S. Army, leaving as a Staff Sergeant (E-6). He served as an M1 Abrams tank commander (MOS 19K) and deployed overseas to combat zones multiple times. On one of those deployments he also took on managing his unit’s unclassified and classified networks, keeping them running and secure in a combat environment. He finished his service as a pistol instructor for special operations. His service earned him the Combat Action Badge and multiple Army Achievement Medals.

Today Darryl’s research focuses on the identity layer, where most modern breaches start. He maps attack paths across on-prem AD and Entra ID, digs into misconfigurations that turn a single compromised account into domain or tenant admin, and turns what he finds into detections and hardening guidance defenders can actually use. He builds open-source tooling as part of that work, including AIHound, a scanner that finds credentials AI assistants and agents leave stored on local machines, and a set of LDAP extended control tools for Active Directory.

For the past four years Darryl has run the Active Directory Hacking Village, a hands-on lab where attendees attack and defend a live Active Directory environment, red team and blue team, side by side. He speaks regularly at security conferences and on webinars, and he writes about identity attacks and defenses for practitioners who need to fix things, not just read about them.

Darryl gives a lot of his time back to the community. He volunteers with Hackers Teaching Hackers, mentors through Blacks In Cybersecurity, and provides pro bono security work for a nature-based early childhood center.