IAM X-ray scans Active Directory, Entra ID, and beyond — and tells you, in plain language, exactly where attackers will go next. No CVSS gymnastics. No vendor marketing. Just the findings that matter, ranked by real-world blast radius.
$ iamxray run --connector ad-live --domain corp.acme.local [ad-live] bound to dc01.corp.acme.local ✓ [scanners] running 31 in topological order... → ad.privileged_groups_discovery 3 groups → ad.kerberoastable [HIGH] 4 accounts → ad.unconstrained_delegation [CRITICAL] 1 account → ad.adcs_esc1 [CRITICAL] 2 templates → ad.dcsync_rights [CRITICAL] 1 principal → ad.standard_accounts_with_priv_access [HIGH] 7 accounts [reports] writing executive-summary.html, full-report.xlsx, evidence.csv, executive-report.pdf Done. 28 findings · 5 critical · 11 high · 9 medium · 3 low▌
Vuln scanners flag CVEs on hosts. They don't see Kerberoastable accounts, AdminSDHolder drift, or that one Tier-1 user who is in Domain Admins via two layers of nested groups.
PowerShell scripts and the Microsoft AD Health checker are point-in-time. They don't follow privilege chains. They don't know your custom delegation groups. And they certainly don't write a clean executive summary.
BloodHound is excellent for incident response. It's not a recurring audit your CISO can read on a Monday. We sit in that gap.
A single pipeline runs across Active Directory, Entra ID, Okta, and offline snapshots. Same engine. Same risk model. Same reports.
Bind read-only via LDAPS, ingest a SharpHound zip, or point at a JSON snapshot. Credentials live in the OS keystore, never in config.
Reverse-engineer your privileged-group registry from confirmed admins. No static "Domain Admins" assumption — we find your custom delegation groups automatically.
Risk-scored findings, evidence rows, plain-language glossary. Interactive HTML, full XLSX, signed PDF. The CSV registry your auditor will actually read.
Each scanner produces a structured Finding with risk-scored evidence, plain-language glossary, and prioritized remediation. Add a scanner = one new file.
Kerberoastable, AS-REP roastable, unconstrained delegation, RBCD, krbtgt rotation, shadow credentials. Mapped to MITRE T1558.
OU-direct user delegation, AdminSDHolder drift, DCSync rights, sensitive-group write paths. Catches the persistence tricks attackers actually use.
ESC1 / ESC2 / ESC3 / ESC8 detection. The rest of the ESC family is one file each — the model is in place.
Walks up from confirmed administrators to discover your actual privileged-group surface — including custom delegation groups static checkers will never find.
Inactive, never-logged-in, disabled-with-groups, externals without expiry, password never expires, password expired, weak password policy.
Out-of-support OS, LAPS coverage gaps, empty OUs, unlinked GPOs, identical-membership clusters, human/non-human classification.
Every run produces an interactive HTML executive summary, a full XLSX, a CSV pair for downstream pipelines, and an archive-grade PDF. Plus a privileged-groups registry CSV your auditor will love.
Connectors translate each IDP into a common model. Scanners read the model. Reports read scanner output. Adding a check is a single file.
Every module is separately licensed. License keys are validated at scanner registration time — Ed25519 signed, offline-verifiable, no phone-home.
31 scanners across account lifecycle, password policy, Kerberos, delegation, ACL surface, AD CS, and inventory. Live + offline.
First scanner: privileged-without-MFA. CA drift, dormant guests, app-consent risk, PIM coverage in development.
Connectors scaffolded. Scanner suite buildout follows customer demand.
Probes the target and writes a customer-config seed. Cuts new-tenant setup from hours to minutes.
Targeted deep-dives on a single user, group, or computer: every relationship, every membership, every cert, every ACL.
Scheduled scans, drift reports, regulatory packs (SOX, PCI-DSS, HIPAA, ISO 27001, NIS2).
Every static "list of priv groups" tool I've used has missed the custom delegation groups my team actually uses. So I built one that walks up from confirmed admins instead.
CVSS scores were never built for identity. krbtgt being old and one stale user account aren't comparable. So we shipped a custom risk model — and we map it back to CVSS so your vuln management tools still get fed.
Spin it up against the synthetic snapshot in two minutes. Open the live HTML report. Decide if you want it pointed at your real environment.