The Challenge
A critical AD that had become a black box
Protecting citizens' data is a core duty for an organization that delivers IT services across every state department.
The Active Directory had become a black box, with limited visibility, massive data sets and inherent vulnerabilities.
A penetration test gave the first warning by uncovering attack paths from an Exchange server into the AD.
Existing tools flagged potential risks but lacked continuous, complete visibility and actionable insights.
Why Saporo
Real risks where an earlier audit fell short
A trusted recommendation introduced the team to Saporo.
The team was already exploring solutions to visualize and understand the attack paths in its AD.
An initial audit with Microsoft did not yield significant results.
Saporo exposed real risks and gave a clear picture of the challenges across a large AD environment.
What We Did
Every attack path mapped, the biggest risks fixed first
Visibility: Detailed logs made extensive AD permissions transparent, so the team could link vulnerabilities to excessive permissions and strengthen its security posture.
Continuity: Previous tools highlighted only the first potential attack path. Saporo showed every possible path for thorough vulnerability management.
Chokepoints: The team found and fixed a broad Group Policy Object (GPO) that had gone unnoticed, significantly reducing the attack surface.
Controls and prioritization: Data-driven insights helped the team prioritize its work, especially permissions tied to SharePoint accounts with non-expiring passwords.
Outcomes
From quarterly audits to weekly posture
Affordable and proven utility: Saporo's cost-effective solution supported collaboration between AD and SOC teams.
First-time visibility: For the first time, the team had a complete, prioritized picture of its AD attack surface.
Continuous monitoring: The administration now addresses security issues weekly rather than quarterly.
Improved collaboration: The administration valued Saporo's rapid response and strong performance.