Attack path mapping
Every delegation, ACL and trust rendered as a graph so you can see the three hops between a helpdesk account and Domain Admin.
PingCastle
Active Directory risk
Your directory is the single point of failure.
Active Directory is quickly becoming a critical failure point in any large company: decades of delegations, trusts and forgotten accounts that are both complex and costly to secure. PingCastle scores the whole thing in minutes.
88%
of breached enterprises had a compromised AD path
< 5 min
average audit runtime on a 50k-object domain
0
bytes of directory data leaving your network
Built for domains nobody fully remembers building.
Risk scoring
A single 0–100 maturity score across privileged accounts, trusts, stale objects and hardening — comparable across every domain you own.
Agentless collection
One signed executable, read-only LDAP queries, no schema change, no service to deploy. Run it from a workstation and hand over the HTML report.
Board-ready reporting
Executive summary, per-rule detail and remediation order in one file that survives being forwarded to auditors.
One score. Every domain. Every month.
The report opens with the number your board will ask about, then drills into the rules that produced it — each with the objects involved, the exploitation scenario and the fix. Re-run it after remediation and the delta is the proof.
- Standalone HTML — no portal, no upload
- Per-rule remediation ordered by effort
- Consolidated view across forests and trusts
Ransomware doesn't break in. It logs in.
In almost every large-scale intrusion, the directory is the pivot: one over-privileged service account, one unconstrained delegation, and the blast radius becomes the whole estate. Knowing which of those exist today is the cheapest control you can buy.
What security teams report back.
"We inherited four forests from acquisitions. PingCastle gave us a comparable score for each in an afternoon — that conversation used to take a consulting engagement."
"The attack path graph is what finally convinced the server team. Nobody argues with a picture showing a print operator reaching Domain Admin."
"Nothing leaves our network, so legal signed off in a day. We now re-run it monthly and track the score in our risk register."
Tell us what your domain broke.
Every rule in PingCastle exists because an engineer sent us a domain we hadn't anticipated. Send findings, false positives or feature requests — they end up in the next release.