The Challenge
A critical AD inheritance with no clear owner
A critical amount of misconfigurations. As a critical healthcare operator, the organization faced government pressure to reach higher standards.
A retiring AD administrator left behind a complex, undocumented environment with no structured handover.
AD lacked proper tiering and segmentation, leaving privilege escalation paths across the environment unaddressed.
Manual audits and periodic audit scans could not scale to an environment of 245,000 identities or surface attack paths at all.
Why Saporo
Manual audits and controls hit their ceiling
Saporo maps findings across 500+ security controls, covering ANSSI, MITRE, CIS, and more, and links each one to its contextual attack path.
Actionable prioritization: Saporo connects each control finding to the attack paths it enables, giving the team a clear, risk-based remediation order across the full identity environment.
No formal tooling was in place. Security coverage depended on two people working part-time with no continuous visibility.
Saporo was selected to go beyond compliance scanning and deliver actionable attack path intelligence across the full identity environment.
What We Did
Mapped every path. Prioritized by real risk
Coverage: Mapped attack paths across the full environment, including Active Directory, AD Certificate Services, Azure, and SMB shares, exposing the complete identity attack surface for the first time and enabling risk-based prioritization.
Tiering and segmentation: Validated AD segmentation and identified the misconfigurations enabling lateral movement between tiers, closing the most critical privilege escalation routes.
Compliance alignment: Findings mapped directly to ANSSI controls and French and European standards, creating a clear, evidence-backed remediation path to desired objectives.
Deployment: Agentless. Operational in one hour. No disruption to clinical systems, with no agents to install or maintain.
Outcomes
From compliance gap to remediated risk
Millions of attack paths eliminated; critical risks across AD, ADCS, Azure, and SMB identified and remediated.
ANSSI compliance objectives met. The compliance threshold the team had been unable to reach through manual means for years was reached within one year with Saporo.
Hundreds of manual audit hours recovered. One administrator now owns what previously required two people working part-time.
Ongoing posture management maintained with minimal upkeep. Security issues are now addressed continuously rather than through periodic audits. Audit reports remain up to date and export-ready