Active Directory Security A Concern?

I had a buddy tell me the other day that his company doesn’t have much of a priority around Active Directory security or recovery (on prem and cloud) meanwhile the company I work at has been spending more and more time on securing pieces to this and improving recovery plans.

Is AD a concern for you guys as well or is it just my company having bad prioritization?

active directory active directory security cloud cybersecurity directory more time plans recovery security spending the company work