Docs menu
See what’s real
The graph, attack paths, risk scores and Security Posture checks.
24 guides
Dashboard and inventory
- Risk dashboardIdentity risk score from eight factors, with peer-group outliers, Critical Junctions, Tiered Fidelity coverage, trend and Platform Health.
- Identity InventoryEvery identity in one risk-sorted table with reach, permissions, group membership and AdminSDHolder flags, plus peer-group outliers (σ) and graph views.
- How posture findings raise riskHow open Security Posture findings, such as Kerberoasting and AS-REP Roasting exposure, set each identity's risk score through the Exposure factor.
The graph
- Graph ExplorerExplore your identity graph with edges, shortest paths, trusts and logon sessions, and see a Tiered Fidelity level on every edge.
- What’s behind a graph lineOpen an edge to see its permissions, ACE origin, fidelity level and constraints, and whether each permission was seen in use in your Windows audit events.
- Unused permissions and Check nowProve a permission went unused by checking an object's replication metadata on every domain controller, and run the check yourself with Check now.
- Blast radius graphs and exact countsBlast radius and permission graphs load hop by hop with exact identity counts at every level, and say plainly when a map is partial.
- List the identities behind a countSelect a bucket on a river or junction graph and list the identities behind its count, in a table that opens in seconds and loads the whole bucket.
- Domain and forest trustsReview forest, external and within-forest trusts, SID filtering, selective authentication and which trusts let an attacker escalate between domains.Active Directory
- Paths across forests and tenantsFind hybrid identity attack paths: identities that escape their forest or Entra ID tenant through sync links or trusts, then investigate or accept them.
Attack paths and risk
- Critical JunctionsFind chokepoints in your identity graph with closeness and betweenness centrality, scored 0 to 10 against attack paths into Critical assets.
- Tier 0 assets and shadow adminsRate identities Low to Critical, find Tier 0 assets and shadow admins through nested groups, and manage built-in and custom criticality rules.
- Over-permissioned identitiesOver-permissioned identities as outliers: permission counts more than 2σ (standard deviations) above the peer-group average, set with Detection Sensitivity.
- Stale and dormant accountsFind stale and dormant accounts past their inactivity threshold from lastLogonTimestamp and lastLogon, with Tier 0 and Critical accounts marked urgent.
- How dormancy affects riskHow GraphnAI ranks disabled accounts below active ones and prices dormant edges higher on attack paths, without excluding either from counts.
- Non-human identitiesFind non-human identities (service accounts, gMSAs, service principals, app registrations) and triage Kerberoastable accounts, expiring credentials and owners.
Security Posture checks
- Account security checksAccount security checks for Kerberoasting (T1558.003), AS-REP Roasting (T1558.004), stale adminCount and risky privileged accounts, with a fix for each.
- Entra ID and hybrid checksTwenty posture checks for Microsoft Entra ID: user consent, device code sign-in, Conditional Access, admin roles and hard-match takeover, with a fix for each.Entra ID
- Service principals and app checksThirteen posture checks for Entra service principals, app registrations and service accounts: tenant takeover, credential backdoors, illicit consent and owners.Entra ID
- Active Directory delegationAudit Active Directory delegation ACEs against Microsoft best practices. Find GenericAll, WriteDacl and cross-plane grants, then remove one with undo.Active Directory
- Group Policy checksGPO security checks for who can edit or link Group Policy, Group Policy Preferences passwords (cpassword) in SYSVOL, and weak NTLM and LLMNR settings.Active Directory
- Certificate Services (AD CS)AD CS certificate templates and CAs in the graph, with ESC1, ESC3, ESC4, ESC5 and ESC13 escalation paths and two posture checks.Active Directory
- Local admins and remote accessSee who has local administrator rights, RDP or PowerShell Remoting on which computers, which Group Policy grants it, and how well each grant is proven.Active Directory
- Cross-tier credential exposureFind computers where a Tier 0 credential sits in memory and a lower-tier account can dump it from LSASS (T1003), using logon events 4624 and 4672.
- Posture check catalogEvery posture check GraphnAI ships, on its own page.