ACTIVE DIRECTORY EXPOSURE
Active Directory controls access across your on-premises environment, and years of nested groups, delegated rights, and stale permissions create hidden paths to Tier 0.
Saporo maps those attack opportunities across Active Directory, ADCS, SMB shares, and Windows local accounts, then prioritizes the changes that best protect your critical systems.
Source: Sophos Active Adversary Report 2026
INSIDE THE PLATFORM
Bring users, groups, computers, organizational units, Group Policies, trusts, and managed service accounts into one view. Connect memberships, permissions, and delegation, then use High Value Target, tier, and business service labels to identify the identities and systems that matter most.
Connect misconfigurations, attack paths, and flagged log events to reveal AD attack opportunities. Prioritize by reachability and potential blast radius, then follow guided recommendations to reduce exposure. With Enterprise workflows, automate supported remediation, and add approval steps before sensitive actions.
Track resolved AD findings, attack paths removed, and access to Tier 0 and other critical assets. Follow Resistance Score and Attack Paths Score trends alongside compliance and tiering results to show how directory hardening improves protection over time, with a step-by-step guide to improve your scores further.
ACTIVE DIRECTORY Q&A
Saporo connects users, groups, computers, organizational units, Group Policies, trusts, ACLs, delegation, and privileged identities. With the corresponding collectors configured, Saporo also brings ADCS, SMB permissions, and Windows local users and groups into the same exposure model.
Saporo collects Active Directory data without agents, using a standard, non-privileged domain account, and changes nothing in the directory. It supports multi-domain and multi-forest environments, with one configuration per domain. It collects directory data through LDAP or LDAPS, and Group Policy content from SYSVOL over SMB.
A misconfiguration describes one weakness. An attack path shows how identities, permissions, delegation, certificates, local privilege, and other relationships can combine into an attack path toward Tier 0 systems or another High Value Target.
Yes. Saporo maps the relationships that can cross privilege boundaries or create reachability toward Tier 0, helping teams find tiering violations and prioritize the changes that strengthen protection around critical systems.
Yes. With the ADCS, SMB Shares, and Windows Local collectors configured, Saporo combines certificate infrastructure, share permissions, and Windows local accounts with Active Directory relationships in the same exposure model.
Saporo uses attack-path context to show which permission, delegation, certificate, or local-security change can break attack and access paths and reduce the most exposure, rather than treating every finding as equally urgent.
Saporo Enterprise includes workflows for supported changes such as disabling dormant accounts, updating group memberships, and correcting unsafe delegation settings. Workflows use configured credentials and can include approval steps before sensitive actions.
