Overview
For most US mid-market organizations, Active Directory still decides whether one stolen password becomes a company-wide outage. We follow each route from a standard employee login up to domain admin, review certificate services and delegation, and check how on-premises identity syncs to the cloud directory. Each path comes with the specific setting to change, ranked by how much of the route it closes.
Active Directory grows by accumulation. Years of groups, delegations, service accounts and permissions build up until an ordinary user, through no single dramatic flaw, has a path to Domain Admin that no one intended or can see. An AD assessment exists to find those paths, because controlling the directory means controlling nearly every system and account that trusts it.
We focus on the abuses that define real intrusions rather than generic misconfiguration. Kerberos weaknesses such as roastable service accounts and unconstrained or resource-based delegation, dangerous access-control entries that let one principal reset another's password or take ownership, over-privileged service accounts, and risky domain and forest trusts are all examined. We model how these combine, because the danger is rarely one setting but a chain of small permissions that together hand over the directory.
Our reporting turns that complexity into action. Alongside scored findings we provide attack-path diagrams that show how initial access becomes domain dominance, mapped to MITRE ATT&CK so your defenders can align detection. Recommendations are prioritized and practical: tiered administration, cleaning up delegation and ACLs, protecting privileged accounts, and the specific changes that collapse the most paths for the least disruption.
How US engagements run
- Delivered remotely from India, 9.5 hours ahead of US Eastern in US daylight time and 10.5 hours in winter; calls and testing windows are set around your time zone at scoping
- Fixed-price proposals in US dollars, with scope, dates and the free retest written in before any work begins
- Written authorization signed by someone with authority over every target, because the federal Computer Fraud and Abuse Act and state laws make permission the dividing line
- Reports that name the requirement a test supports, such as PCI DSS 11.4, the FTC Safeguards Rule or SOC 2, without claiming a QSA, ASV or C3PAO role we don't hold
What's included
Our approach
- Access & enumerationFrom a standard account we collect the directory's objects and relationships.
- Path analysisWe model permissions and trusts to reveal routes toward privileged access.
- Technique testingKerberos, ACL, delegation and credential techniques are tested along those routes.
- Dominance demonstrationWe safely demonstrate the shortest realiztic path to domain control.
- Report & debriefAttack-path diagrams, ATT&CK mapping and a prioritized hardening plan are delivered.
What you receive
- Attack-path diagrams from standard account to Domain Admin
- Findings mapped to MITRE ATT&CK with CVSS v4.0 scores
- Review of Kerberos, delegation, ACL and trust risks
- Prioritized tiering and hardening roadmap
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- MITRE ATT&CK
- PTES
- NIST SP 800-115
- CIS Benchmarks
- CVSS v4.0
- CWE
- PCI DSS v4.0.1 Req. 11.4
- NIST SP 800-171
Frequently asked questions
What access do you need for an AD assessment?
A single standard domain user account and network reachability to the domain controllers is enough to begin. Most of the value comes from showing how ordinary access escalates, which is exactly what a low-privileged starting point lets us demonstrate.
Is enumeration safe to run in production?
Yes. The collection techniques we use read the directory in the way ordinary domain-joined systems do and do not change objects. Any technique that could affect accounts or tickets is discussed with you first and run carefully, avoiding disruption.
How is this different from an internal network test?
An internal test covers the whole network and all its services; an AD assessment drills specifically into the identity layer, the permissions, Kerberos, delegation and trusts that turn a foothold into domain control. They complement each other and are often run together.
Does an internal and external test cover PCI DSS Requirement 11.4?
It can, when scoped for it. PCI DSS v4.0.1 wants penetration tests from inside and outside the network every year and after significant changes, following a documented methodology, plus proof that segmentation holds. We aren't a QSA or ASV, so quarterly ASV scans and the assessment itself stay with those firms.
Can you test our US networks without traveling?
Network, Active Directory, cloud and Kubernetes testing run remotely through a VPN account, jump host or small test device you place on the network. Wireless and hardware work need someone near the equipment; tell us the sites at scoping and we'll say plainly whether and how we can cover them.