Feature

All features

Discover every capability that powers Saporo — from graph-based attack path analysis to continuous hardening and integrations.

Graph Engine & Analysis

At the core of Saporo is a high-performance graph engine that maps every identity, permission, and relationship.

Visualize and control complexity

Saporo’s graph engine transforms sprawling identity data into a single model you can explore and analyze. It connects accounts, groups, permissions, and resources into a living map, so you can see not just what exists — but how attackers could exploit it.

Hybrid identity graph
Bring together Active Directory, Entra ID, ADCS, Okta, AWS IAM, and more in one consolidated view. No silos, no blind spots.
Attack path calculation
Graph algorithms identify chains of permissions that can be abused to move laterally or escalate privileges. This goes beyond single misconfigs to show how risks combine.
Chokepoint identification
Automatically highlight the accounts, groups, or resources that sit at the center of up to millions of attack paths. Solving these chokepoints cuts off entire classes of attacks.
Impact simulation
Preview how removing a permission or disabling an account will affect attack paths — before you touch production. This lets teams fix issues confidently without breaking workflows.

By connecting identities and permissions into one model, Saporo enables security teams to move past static lists and see the bigger picture. The graph engine makes identity risk measurable, understandable, and most importantly, fixable.

Misconfiguration & Risk

Surface the misconfigurations that create hidden openings for attackers. From dormant privileges to risky inheritance, Saporo continuously highlights the issues that weaken your identity posture.

From noise to clear priorities

Traditional tools produce long lists of technical issues with little context. Saporo analyzes accounts, groups, and policies in relation to your environment, surfacing the weaknesses that matter most and showing you how to fix them.

Comprehensive library
Aligned with ANSSI, MITRE, ISO and Microsoft best practices — continuously updated to reflect evolving attacker techniques.
Unused permissions
Identify accounts and groups holding rights they haven’t exercised for months. Removing these reduces privilege sprawl and minimizes potential entry points.
Tiering exposures
Automatically detect exposures that break Microsoft’s Tier Model, making it easier for attackers to pivot from lower-tier accounts into critical infrastructure.
Hidden privilege inheritance
Uncover shadow admins, AdminSDHolder persistence, and other stealthy privilege paths that attackers use for long-term control.

Saporo transforms misconfigurations from endless lists into a clear, prioritized roadmap for hardening. By surfacing the issues that pose the greatest risk, it enables teams to act with focus and confidence.

Monitoring & Hardening

Saporo continuously monitors your environment, tracks posture changes, and quantifies resilience with clear resistance scores — so you know when risk is growing and how hardening efforts are paying off.

Measure, monitor, and improve

Every identity change shifts your attack surface. Saporo tracks these shifts in real time, updating resistance scores that combine attack path exposure, misconfigurations, and log events into a single, easy-to-understand benchmark. Teams can spot drift immediately and demonstrate improvements over time.

Continuous posture monitoring
Automatically refreshes analysis with every new dataset, ensuring findings always reflect the current state of your environment.
Resistance scores
A single set of scores that quantify risk across attack paths and misconfigurations. Use them to benchmark posture and measure progress.
Baseline drift alerts
Immediate visibility when posture weakens compared to hardened baselines or when new exposures emerge.
Log collection & analysis
Collects logs from AD, domain controllers, Azure, and more to track who changed what, when permissions were used, and surface abnormal changes.
Trend dashboards
Track changes over time: score improvements, attack paths removed, segmentation progress, tagging status and overall hardening impact.

With Saporo, monitoring isn’t just about spotting changes — it’s about measuring resilience. Resistance scores and trend visibility provide the clarity needed to prove progress, maintain control, and ensure environments stay hardened as they evolve.

Continuous posture monitoring
Automatically refreshes analysis with every new dataset, ensuring findings always reflect the current state of your environment.
Resistance scores
A single set of scores that quantify risk across attack paths and misconfigurations. Use them to benchmark posture and measure progress.
Baseline drift alerts
Immediate visibility when posture weakens compared to hardened baselines or when new exposures emerge.
Log collection & analysis
Collects logs from AD, domain controllers, Azure, and more to track who changed what, when permissions were used, and surface abnormal changes.
Trend dashboards
Track changes over time: score improvements, attack paths removed, segmentation progress, tagging status and overall hardening impact.

Continuous posture monitoring
Automatically refreshes analysis with every new dataset, ensuring findings always reflect the current state of your environment.
Resistance scores
A single set of scores that quantify risk across attack paths and misconfigurations. Use them to benchmark posture and measure progress.
Baseline drift alerts
Immediate visibility when posture weakens compared to hardened baselines or when new exposures emerge.
Log collection & analysis
Collects logs from AD, domain controllers, Azure, and more to track who changed what, when permissions were used, and surface abnormal changes.
Trend dashboards
Track changes over time: score improvements, attack paths removed, segmentation progress, tagging status and overall hardening impact.

Coverage

Saporo provides full coverage across the identity systems that matter most. From AD to Entra ID and companion sources like Okta and AWS, it unifies them into one model so attackers have nowhere to hide.

Comprehensive identity coverage

Identity today spans multiple worlds — legacy AD, modern cloud directories, SaaS identity providers, and cloud infrastructure. Saporo connects them all, mapping permissions, misconfigurations, and attack paths into one graph. With this unified view, you see risks that span across silos and can harden your environment end-to-end.

Active Directory, ADCS and SMB Shares
Full coverage of AD forests, trusts, ACLs, and group structures, with deep mapping of ADCS objects and templates. Surface excessive privileges, delegation paths, weak GPOs, and certificate issues that attackers exploit to escalate. Extend this visibility into SMB shares to uncover excessive access and lateral movement opportunities that expose sensitive data and critical infrastructure.
Azure, Entra ID and M365
Analyze risky app consents, admin assignments, and legacy authentication. Model how OAuth abuse or role misconfigurations can create tenant-wide compromise. Enforce 220+ mapped controls (CIS, MITRE, ANSSI, ISO) across Entra ID and Microsoft 365 for continuous hardening.
Companion sources
Extend visibility with companion identity sources like Okta and AWS IAM to complete the hybrid map. Highlight risky delegations, oversharing, and over-permissive roles. Coming soon: expanded coverage for GitHub, Kubernetes, and other critical platforms.

Saporo unifies identity risk coverage across on-prem and cloud, eliminating blind spots that attackers exploit. By combining AD, Entra ID, and companion sources into a single model, it delivers a complete picture of identity posture — and one place to harden it.

Scale & Performance

Saporo is built to scale. Whether you have thousands or millions of identities, permissions, and relationships, it delivers analysis and results without slowing down.

High performance at enterprise scale

Identity environments can quickly grow massive — spanning AD forests, Entra ID tenants, SaaS integrations, and cloud resources. Saporo’s graph engine is optimized to handle these environments at scale, processing millions of nodes and edges while keeping analysis fast and interactive.

Enterprise-scale graph engine
Processes millions of identities, permissions, and attack paths in memory, ensuring fast analysis even in complex hybrid environments.
Real-time responsiveness
Interactive queries and visualizations stay quick, no matter the size of your environment — from small businesses to global enterprises.
Optimized storage & computation
Built with efficient algorithms and smart indexing to minimize load times and maximize graph traversal speed.
Proven in large-scale environments
Trusted by organizations with multi-forest AD, large M365 tenants, and hybrid deployments. Designed to handle continuous growth without performance trade-offs.

Saporo combines speed and scale, giving teams instant visibility into risks no matter how complex their environment. By keeping performance consistent across small to massive deployments, it ensures identity risk management never becomes a bottleneck.

Enterprise-scale graph engine
Processes millions of identities, permissions, and attack paths in memory, ensuring fast analysis even in complex hybrid environments.
Real-time responsiveness
Interactive queries and visualizations stay quick, no matter the size of your environment — from small businesses to global enterprises.
Optimized storage & computation
Built with efficient algorithms and smart indexing to minimize load times and maximize graph traversal speed.
Proven in large-scale environments
Trusted by organizations with multi-forest AD, large M365 tenants, and hybrid deployments. Designed to handle continuous growth without performance trade-offs.

Enterprise-scale graph engine
Processes millions of identities, permissions, and attack paths in memory, ensuring fast analysis even in complex hybrid environments.
Real-time responsiveness
Interactive queries and visualizations stay quick, no matter the size of your environment — from small businesses to global enterprises.
Optimized storage & computation
Built with efficient algorithms and smart indexing to minimize load times and maximize graph traversal speed.
Proven in large-scale environments
Trusted by organizations with multi-forest AD, large M365 tenants, and hybrid deployments. Designed to handle continuous growth without performance trade-offs.

Attack Path Chokepoints

Stop attackers at scale by finding the chokepoints — the permissions, groups, or identities that sit at the center of millions of attack paths.

One fix, massive impact

Attackers exploit chains of misconfigurations and permissions to reach high-value targets. Saporo identifies the chokepoints that appear across many of these paths, showing you where a single remediation can eliminate entire clusters of risk.

All-path visibility
Every possible attack path across AD, Entra ID, and companion sources is analyzed, giving a complete view of how identities can be exploited.
Chokepoint identification
Identify accounts, groups, and resources that concentrate risk across many paths, where one fix can collapse millions of routes.
Attack models
Prioritize chokepoints based on models like ransomware propagation, DC Sync, or privilege escalation, reflecting real attacker methods.
Business impact assessment
Simulate how cutting a chokepoint affects access to business services, ensuring remediation reduces risk without disrupting critical systems.

Chokepoints shift remediation from chasing single issues to eliminating entire clusters of risk. With Saporo, teams see where attackers converge — and cut them off efficiently.

All-path visibility
Every possible attack path across AD, Entra ID, and companion sources is analyzed, giving a complete view of how identities can be exploited.
Chokepoint identification
Identify accounts, groups, and resources that concentrate risk across many paths, where one fix can collapse millions of routes.
Attack models
Prioritize chokepoints based on models like ransomware propagation, DC Sync, or privilege escalation, reflecting real attacker methods.
Business impact assessment
Simulate how cutting a chokepoint affects access to business services, ensuring remediation reduces risk without disrupting critical systems.

Chokepoints shift remediation from chasing single issues to eliminating entire clusters of risk. With Saporo, teams see where attackers converge — and cut them off efficiently.

All-path visibility
Every possible attack path across AD, Entra ID, and companion sources is analyzed, giving a complete view of how identities can be exploited.
Chokepoint identification
Identify accounts, groups, and resources that concentrate risk across many paths, where one fix can collapse millions of routes.
Attack models
Prioritize chokepoints based on models like ransomware propagation, DC Sync, or privilege escalation, reflecting real attacker methods.
Business impact assessment
Simulate how cutting a chokepoint affects access to business services, ensuring remediation reduces risk without disrupting critical systems.

Chokepoints shift remediation from chasing single issues to eliminating entire clusters of risk. With Saporo, teams see where attackers converge — and cut them off efficiently.

AI & Assisted Resolution

Saporo goes beyond analysis. It provides clear, prescriptive recommendations — enhanced with AI assistance — so teams can remediate with confidence.

From findings to fixes

Security teams don’t just need to know what’s wrong, they need to know how to fix it. Saporo generates tailored recommendations for every issue, enriched with AI explanations that clarify risks and propose safe remediation steps.

Contextual recommendations
Every finding is paired with a prescriptive fix tailored to your specific AD, Entra ID, or cloud environment. A script or cmd to fix the issue is provided when possible.
AI-powered guidance
LLM assistance (cloud or on-prem) explains complex risks in plain language and suggests remediation steps aligned to best practices.
Framework mapping
Recommendations link directly to ANSSI, MITRE, ISO, and CIS controls, making it easy to align fixes with compliance goals.

With AI-assisted resolution, Saporo transforms posture management into action. Teams get clear fixes, trusted guidance, and the confidence to harden identities without fear of breaking critical systems.

Contextual recommendations
Every finding is paired with a prescriptive fix tailored to your specific AD, Entra ID, or cloud environment. A script or cmd to fix the issue is provided when possible.
AI-powered guidance
LLM assistance (cloud or on-prem) explains complex risks in plain language and suggests remediation steps aligned to best practices.
Framework mapping
Recommendations link directly to ANSSI, MITRE, ISO, and CIS controls, making it easy to align fixes with compliance goals.

Contextual recommendations
Every finding is paired with a prescriptive fix tailored to your specific AD, Entra ID, or cloud environment. A script or cmd to fix the issue is provided when possible.
AI-powered guidance
LLM assistance (cloud or on-prem) explains complex risks in plain language and suggests remediation steps aligned to best practices.
Framework mapping
Recommendations link directly to ANSSI, MITRE, ISO, and CIS controls, making it easy to align fixes with compliance goals.

Advanced Exploration

Go beyond predefined views with graph exploration, custom queries, and reporting tailored to your environment.

Saporo pre written custom queries interface

Explore, query, and report

Every environment is unique. Saporo lets you freely explore the identity graph, run custom queries against graph data or logs, and generate reports and dashboards powered by Elastic — giving teams unmatched flexibility to analyze identity risk.

Graph exploration
Interact with the identity graph to uncover relationships, inheritance, and attack paths beyond what predefined reports capture. Explore your environment like an attacker would.
Graph query builder
Run prebuilt or custom Cypher-style queries on Saporo’s graph database to investigate risks and test hypotheses.
Log queries with Elastic
Search and analyze collected logs directly, using Elastic to pivot from identity findings into operational evidence.
Custom reports & dashboards
Leverage Elastic to build tailored dashboards and reports that combine Saporo findings with log data for compliance or executive visibility.

Saporo gives analysts the freedom to dig deep and adapt analysis to their environment. Whether exploring the graph, querying logs, or building dashboards, teams can shape insights their way — all backed by scalable, high-performance engines.

Graph exploration
Interact with the identity graph to uncover relationships, inheritance, and attack paths beyond what predefined reports capture. Explore your environment like an attacker would.
Graph query builder
Run prebuilt or custom Cypher-style queries on Saporo’s graph database to investigate risks and test hypotheses.
Log queries with Elastic
Search and analyze collected logs directly, using Elastic to pivot from identity findings into operational evidence.
Custom reports & dashboards
Leverage Elastic to build tailored dashboards and reports that combine Saporo findings with log data for compliance or executive visibility.

Graph exploration
Interact with the identity graph to uncover relationships, inheritance, and attack paths beyond what predefined reports capture. Explore your environment like an attacker would.
Graph query builder
Run prebuilt or custom Cypher-style queries on Saporo’s graph database to investigate risks and test hypotheses.
Log queries with Elastic
Search and analyze collected logs directly, using Elastic to pivot from identity findings into operational evidence.
Custom reports & dashboards
Leverage Elastic to build tailored dashboards and reports that combine Saporo findings with log data for compliance or executive visibility.

Enterprise Ready

Saporo is built for the enterprise, with the security, governance, and access controls large organizations expect.

Security and governance by design

Identity security solutions must themselves meet the highest standards. Saporo includes enterprise-grade features like role-based access, SSO, MFA, and full audit logging to ensure the platform is as secure and compliant as the environments it protects.

Role-based access control (RBAC)
Granular permissions let you define who can view, manage, or export findings based on role and responsibility.
Single sign-on (SSO)
Integrate with your Active Directory or Entra ID provider for centralized authentication, simplifying user management and access.
Multi-factor authentication (MFA)
Strengthen login security with MFA enforcement, ensuring that only authorized users can access sensitive data.
Audit trails
Comprehensive logging of user activity and changes provides accountability and supports compliance audits.
ISO 27001 certified
Saporo’s platform and processes are certified against the ISO 27001 standard, demonstrating commitment to the highest level of information security.

With enterprise-ready access controls and auditability, Saporo is secure by design. It scales confidently into regulated industries and global enterprises, meeting the same standards it helps customers enforce.

Role-based access control (RBAC)
Granular permissions let you define who can view, manage, or export findings based on role and responsibility.
Single sign-on (SSO)
Integrate with your Active Directory or Entra ID provider for centralized authentication, simplifying user management and access.
Multi-factor authentication (MFA)
Strengthen login security with MFA enforcement, ensuring that only authorized users can access sensitive data.
Audit trails
Comprehensive logging of user activity and changes provides accountability and supports compliance audits.
ISO 27001 certified
Saporo’s platform and processes are certified against the ISO 27001 standard, demonstrating commitment to the highest level of information security.

Role-based access control (RBAC)
Granular permissions let you define who can view, manage, or export findings based on role and responsibility.
Single sign-on (SSO)
Integrate with your Active Directory or Entra ID provider for centralized authentication, simplifying user management and access.
Multi-factor authentication (MFA)
Strengthen login security with MFA enforcement, ensuring that only authorized users can access sensitive data.
Audit trails
Comprehensive logging of user activity and changes provides accountability and supports compliance audits.
ISO 27001 certified
Saporo’s platform and processes are certified against the ISO 27001 standard, demonstrating commitment to the highest level of information security.

Try it yourself

Request your demo

Hundreds of misconfigurations, thousands of permissions, one solution.
See how Saporo reduces systemic identity risk at scale.

Request demo

Try it yourself

Request your demo

Hundreds of misconfigurations, thousands of permissions, one solution.
See how Saporo reduces systemic identity risk at scale.

Request demo

Try it yourself

Request your demo

Hundreds of misconfigurations, thousands of permissions, one solution.
See how Saporo reduces systemic identity risk at scale.

Request demo