The Challenge
No visibility. No Prioritization. No clear path forward
No formal tooling in place. Identity risk was managed through manual audits, PingCastle scans, and ad hoc penetration tests.
The team could identify that risks existed, but had no way to understand their scope, feasibility, or relative priority across a 300,000-identity environment.
Two people working part-time were responsible for AD security across AD, ADCS, and Azure with no continuous coverage between audits.
PingCastle and penetration tests generated findings, but no unified view of how risks connected or which posed the greatest threat.
Why Saporo
Where point-in-time tools hit their limit
PingCastle provided configuration scores but no attack path context. The team couldn't see how misconfigurations translated into exploitable routes to critical assets.
Manual pentests surfaced individual findings but couldn't scale to the full environment or provide ongoing coverage.
The bank needed a way to move from a list of findings to a prioritized, evidence-backed remediation roadmap.
Saporo bridges that gap: attack path intelligence across the full hybrid environment, not just point-in-time findings.
What We Did
Mapped every path. Prioritized by real risk
Full environment coverage: Attack paths mapped across AD, ADCS, and Azure, unified identity attack surface visibility for the first time.
Prioritization at scale: Attack paths ranked by feasibility and impact, replacing guesswork with evidence-backed remediation sequencing.
Tiering & segmentation: AD segmentation validated; misconfigurations enabling lateral movement and privilege escalation surfaced and resolved.
Deployment: Agentless. Operational in one hour. No disruption to banking operations.
Outcomes
From blind spots to measurable results
10 million attack paths eliminated; critical risks across AD, ADCS, and Azure identified and remediated.
Hundreds of misconfigurations resolved across the full environment.
Hundreds of manual audit hours recovered. The same team now covers significantly more ground without adding headcount.
Ongoing posture management maintained with minimal upkeep. Security issues now addressed continuously rather than through periodic audits.