The cost argument for leaving NetNTLMv1 enabled just collapsed — Sophos published a CPU-only rainbow-table pipeline that recovers the NT hash in under 20 minutes on one server, work that previously occupied GPUs for up to eight hours, and released the tool

NetNTLMv1 has survived in Active Directory estates for a decade on an implicit cost argument. The protocol encrypts the derived NT hash under 56-bit DES, which is mathematically broken, but recovering a key from a captured response has meant either a large precomputed table set and hours of GPU time or a cracking rig nobody has spare — so a legacy exception for an old appliance, a scanner or an unsupported application has looked like an accepted risk rather than an open door. Sophos X-Ops published the work that removes the cost side of that argument.

The engineering is straightforward and is the point. A scalar CPU implementation reaches about 144 million DES operations per second on a 64-core EPYC, which puts a single precompute at about 45 minutes and spends most of that time in the DES key schedule rather than in encryption. Bitslicing treats a CPU register as parallel one-bit lanes instead of one value, turning each DES S-box into a small Boolean gate network; widening the slice from a 64-bit word to a 256-bit AVX2 vector quadruples the parallelism to 256 simultaneous DES operations; and because a rainbow chain derives its keys deterministically, the key schedule can be replaced by a precomputed wiring map — which matters because, as Sophos puts it, the key schedule was 85% of the scalar cost. The result is about 2.1 billion DES operations per second on a single 64-core EPYC, roughly fifteen times the scalar baseline, and a precompute that drops from about 45 minutes to about three (Sophos X-Ops, 2026-08-17).

The end-to-end figure is the one to carry into a risk conversation: "The same downgrade lookup that previously occupied GPUs for up to eight hours now completes in under 20 minutes on a single server, and faster across a small cluster, without consuming a single GPU cycle" (Sophos X-Ops, 2026-08-17). The table set it runs against is not new either — Sophos states that in 2026 Mandiant published a complete NetNTLMv1 DES rainbow table set for the fixed-challenge scenario, 4,096 files of roughly 2 GB each covering the full 2^56 keyspace at about 9 TB total — so the precomputation is a public good the attacker does not have to fund. Sophos has released its own implementation publicly as a dependency-free C toolset. Nothing in the chain now requires specialist hardware or a specialist budget.

Sophos is equally clear about what still gates it, and this is the half a defender can act on: the attacker needs a captured v1 response taken under a static server challenge. The article names the standard forced-authentication tooling flags used to request that downgrade, and notes plainly that sometimes it works and sometimes it does not — where it does not, the GPUs remain the fallback. That precondition is the whole control surface. An estate that does not negotiate NetNTLMv1 produces no response for the pipeline to consume; an estate that does produces one for every coerced or poisoned authentication its hosts answer.

Its closing observation generalises past this protocol: "Threat actors thrive on the availability of legacy technology that survives long after its security integrity has expired" (Sophos X-Ops, 2026-08-17).