Kerberos
The ticket-based authentication protocol Active Directory uses to prove identity without sending passwords over the network.
A user authenticates once and receives a ticket-granting ticket, which is then exchanged for service tickets as they access resources. It avoids repeatedly transmitting credentials, which was a genuine improvement over what came before.
Its ticket mechanics create their own attack surface, including Kerberoasting and forged tickets that grant long-lived access. Those attacks target the protocol working as designed rather than a bug in it.
Where this comes up
Kerberos sits inside our identity and access work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.