An in-depth review of Active Directory and Entra ID configuration, privileges and attack paths that lead to full domain compromise.
Active Directory is the main target in most ransomware attacks. We analyse privileges, delegations, Group Policy, Kerberos settings and hybrid identity to find the paths an attacker would use, and show how to break them.
.svg){kind=small}
Privileged group and delegation analysis
Attack path mapping to domain admin
Kerberos, NTLM and legacy protocol review
Hybrid identity and Entra ID connection review
What’s included
Every Active Directory Security Review engagement is scoped to your systems, risks and team, with clear outcomes agreed before work starts.
Graph-based analysis shows every route from ordinary users to critical privilege.
Settings checked against hardening guidance and known attack techniques.
A practical administrative tier model to protect your most sensitive accounts.
A red team tests your people, processes and technology together, the way a determined attacker would. Our specialist assessments go deep on the technologies attackers most often abuse.
Agree goals, scope, rules of engagement and safety controls with a small trusted group.
Research your organisation, people and exposed systems as an attacker would.
Pursue objectives using realistic tactics while avoiding detection.
Walk defenders through every step and help them improve detection and response.
Deliverables
Outcomes
See how your defences hold up against a determined, skilled attacker.
Find out whether your SOC notices and responds, not just whether controls exist.
Focus on the weaknesses that led to real objectives being reached.
A clear narrative leadership can understand and act on.
Keep exploring
Tell us about your environment, timelines and goals. We will come back with a clear scope and quote.
Request a quote
.webp)
