How do we reset passwords safely after a breach?
From a clean device, in a planned order and within one short window. Start with the accounts that control everything: domain and cloud administrators, the backup system, remote access, and service accounts with broad rights. In Active Directory, the Kerberos ticket-signing account (krbtgt) is reset twice, with time for replication in between, so that forged tickets stop working. Then reset ordinary users, revoke active sessions and tokens in cloud services, and require multi-factor authentication (MFA) wherever it is missing. Do not send new passwords by e-mail that may be compromised. If you reset too early, while the attacker still has a foothold, they simply capture the new passwords, so contain first. Identity changes are outside a network sensor's view; NetSenX shows whether the attacker's machines keep reaching out afterwards.