Saporo, Order in chaos

SMB SHARES EXPOSURE

Reduce SMB share exposure

Saporo connects SMB shares and their NTFS permissions to directory identities and attack paths.

Identify broad access, risky ownership, SMBv1, and unenforced SMB signing, then prioritize the changes that reduce exposure to shared resources and critical assets.

Book a demoFree assessment
SMB Shares
  • Shares
  • Folders
  • Permissions
  • Ownership
  • Inheritance
  • Users & groups

Insufficient access controls on network shares and services are one of the 10 most common misconfigurations NSA and CISA find in large organizations.

Source: NSA and CISA joint advisory AA23-278A, Top Ten Cybersecurity Misconfigurations

INSIDE THE PLATFORM

See SMB share exposure in Saporo

Map shares and permissions

Bring discovered shares and collected folders into one view, including share ownership and NTFS permissions. Connect them to AD users, groups, and hosting computers to understand who can reach shared resources. See how excessive access or risky ownership exposes shared resources and critical assets.

Saporo Inventory for SMB Shares showing 10 admin shares, 61 standard shares, and 232 folders, and the Admin Shares table listing shares such as ADMIN$, C$, IPC$, NETLOGON, and SYSVOL on PROD-AD-SAPORO-01 and PROD-WINLOCAL01 with high value, high risk, business service, node type, scope, and impact rating in an example environment

Discover and remediate exposure

Uncover broad permissions, risky ownership, and attack paths involving shared resources. Review relevant misconfigurations to investigate related attack opportunities prioritized by impact. Follow guided fixes to reduce exposure.

Saporo attack path finding where the built-in Users group has read-write access to an SMB share on a domain controller, with 926 sources and the recommended remediation, in an example environment
1 / 3

Measure your security progress

Track resolved share findings, reduced access to sensitive resources, and attack paths involving shares. Use Resistance Score, Attack Paths Score, control results, and tiering dashboards to show how permission changes reduce exposure.

Saporo Overview score widget on the Resistance tab, with a Medium Resistance Score of 69.6%, the change over the last 30 days, an Increase your score action, the rating scale, and the Resistance Score over time chart with Attack Paths and Compliance lines and event flags, in an example environment
1 / 4

Data sources

SMB SHARES Q&A

Understand share exposure

Saporo uses agentless, authenticated collection to discover SMB shares and analyze NTFS permissions, share ownership, and SMB protocol settings such as SMBv1 and SMB signing. Shares are linked to their hosting computers and directory identities. Folder coverage depends on the configured folder scan depth (by default, share roots only) and the collection account’s access.

Users can receive access through group membership and inherited permissions. Connecting shared resources to directory relationships helps your team understand which identities can reach data and why.

Saporo’s SMB analysis focuses on permissions, ownership, and configuration metadata. It does not scan file contents to identify credentials or classify sensitive documents.

Saporo uses attack-path context, reachability, and impact on High Value Targets to prioritize SMB findings. This helps teams review share permissions and ownership in the context of their wider identity environment.

SMB Shares focuses on access to shared resources and the permissions behind it. Windows Local focuses on accounts, local group memberships, administrators, and privilege assignments on computers. Both can be analyzed with connected directory relationships.

Reduce identity exposure before it becomes an attack

Book a demo