Why is it weak?
The EVERYONE group has GenericAll permission over DOMAINADMINS_SUB. GenericAll grants full control over an Active Directory object, and every object that can access EVERYONE inherits that control.
Attack Path Reduction
Close the attack paths that put critical assets at risk
See how attackers could reach your critical assets. Find the changes that remove the most attack paths.
Discover all attack paths to critical assets
Understand how attackers could use human and non-human identities to reach Tier 0 and other High Value Targets across on-premises and cloud environments.
Paths to critical assets
Find direct and indirect attack paths to Tier 0 and other High Value Targets.
All permissions in one graph
See how all existing permissions and weaknesses combine into toxic attack paths.
Segmentation you can trust
Knowing every path makes total preemptive identity segmentation possible.
Validate attack paths before you act
See why an attack path is possible, how an attacker could use the permission behind it, and what to change. When many paths depend on that permission, it is a chokepoint.
How could an attacker use it?
Any of 758 sources can use that one permission to take control of the group and move on to 305 targets. Saporo counts 231,190 attack paths through this link.
How do you fix it?
The recommended remediation is to limit or remove the permission. Each finding also carries recommendations, business impact, exploitation, and detection guidance.
One change can cut millions of attack paths
Saporo often discovers millions and sometimes billions of attack paths in the largest environments. Chokepoints turn that overwhelming scale into focused action: find the permissions those paths share and remove millions of paths with a single change.
Path by path
Investigate and fix each attack path individually. Across millions of paths, this can mean thousands of hours or years of work, making the task practically impossible.
By chokepoint
Investigate a shared permission once and fix it once. Cut every attack path that depends on it, saving countless hours of manual investigation and remediation.
- High-impact chokepoints can eliminate millions of attack paths
- 5–20
- High-impact chokepoints can eliminate millions of attack paths
- Paths to Tier 0 collapsed through focused remediation
- 80–95%
- Paths to Tier 0 collapsed through focused remediation
Attack Path Reduction Q&A
What teams ask about attack path reduction
An attack path is a chain of permissions and relationships an attacker could exploit to reach critical assets. Saporo reveals these attack paths so you can close them before attackers use them.
Saporo maps attack paths to your High Value Targets, including Tier 0 identities and critical resources across on-premises and cloud. See what attackers could reach and where your most important assets are exposed.
See the key permission, affected identities, reachable critical assets, impact, and recommended fix in one place. Understand how the path could be exploited and where to act.
Many attack paths depend on the same permission, known as a chokepoint. Restricting or removing that permission can eliminate millions of paths with one targeted change.
Saporo combines reachability, exposure to compromise, propagation potential, and impact on critical assets to prioritize chokepoints. Focus your team on targeted permission changes that close more attack paths and reduce exposure.
Saporo reanalyzes attack paths and shows which findings have been resolved. Track remaining paths, exposure reduction, and Resistance Score trends to demonstrate the results of your remediation.