Every module is a separately-licensed package. Ed25519-signed license files; no phone-home; entitlement enforced at scanner registration time.
Every module is separately licensed. License keys are validated at scanner registration time — Ed25519 signed, offline-verifiable, no phone-home.
31 scanners across account lifecycle, password policy, Kerberos, delegation, ACL surface, AD CS, and inventory. Live + offline.
First scanner: privileged-without-MFA. CA drift, dormant guests, app-consent risk, PIM coverage in development.
Connectors scaffolded. Scanner suite buildout follows customer demand.
Probes the target and writes a customer-config seed. Cuts new-tenant setup from hours to minutes.
Targeted deep-dives on a single user, group, or computer: every relationship, every membership, every cert, every ACL.
Scheduled scans, drift reports, regulatory packs (SOX, PCI-DSS, HIPAA, ISO 27001, NIS2).
Spin it up against the synthetic snapshot in two minutes. Open the live HTML report. Decide if you want it pointed at your real environment.