# GraphnAI

> GraphnAI is a self-hosted identity security platform. It maps every identity and permission in your directories, Active Directory and Microsoft Entra ID, into one graph, labels how much evidence stands behind each relationship (Theoretical, Constrained or Validated), finds the attack paths to Tier 0 and the junctions they pass through, detects identity attacks in domain controller security events, and fixes problems through Select Fire, which simulates every change first and only runs changes it can reverse. Graphne is its AI assistant: it answers in plain language through a read-only database account and shows its work. A free 30-day Public Preview runs on your own server.

Each page below is also available as Markdown: add .md to its address.

## Product
- [How it works](https://www.graphnai.com/product.md): Tables that open into graphs.
- [See what's real](https://www.graphnai.com/product/exposure.md): Fidelity tiers, attack paths, posture.
- [Fix it safely](https://www.graphnai.com/product/remediation.md): Simulate, Select Fire, roll back.
- [Catch attacks](https://www.graphnai.com/product/detection.md): Detections, triage, investigations.
- [Graphne](https://www.graphnai.com/product/graphne.md): The agent that shows its work.
- [Integrations](https://www.graphnai.com/integrations.md): Directories, telemetry, sign-in, API.
- [Play the graph](https://www.graphnai.com/play.md): Explore a sample company in your browser.
- [Weekly puzzle](https://www.graphnai.com/puzzle.md): Path to Domain Admins. A new one each week.

## Industries
- [Healthcare](https://www.graphnai.com/industries/healthcare.md): Shared workstations, clinical service accounts and rotating staff.
- [Financial services](https://www.graphnai.com/industries/financial-services.md): Privileged access, separation of duties and audit evidence.
- [Government](https://www.graphnai.com/industries/government.md): The tier model, legacy domains and trusts, on your own network.
- [Education](https://www.graphnai.com/industries/education.md): Term-by-term churn, stale identities and a small team.

## Reference
- [Detection catalog](https://www.graphnai.com/detections.md): Every detection rule, with its ATT&CK technique.
- [Posture check catalog](https://www.graphnai.com/checks.md): Every posture check, and how to fix it.
- [Blog](https://www.graphnai.com/blog.md): Founder posts on identity security.

## Get started
- [Start your free Preview](https://www.graphnai.com/preview.md): 30 days on your own server, from your first sync.
- [Pricing](https://www.graphnai.com/pricing.md): per enabled user per year, Exposure $36, Complete $60, with a 250-user minimum. Computers, groups and non-human identities are free.
- [Trust](https://www.graphnai.com/trust.md): architecture, data handling, keys, AI controls and support access.
- [Documentation](https://www.graphnai.com/docs.md): the user guides, listed below.
- [Changelog](https://www.graphnai.com/changelog.md): what shipped, release by release.

## Docs: Get started
- [Quick Start: Self-Hosted Deployment with Docker Compose](https://www.graphnai.com/docs/guides/quick-start-self-hosted.md): Install GraphnAI with Docker Compose: extract the deployment bundle, start the stack, import your license and set up sign-in in under 10 minutes.
- [Hardware Sizing Guide](https://www.graphnai.com/docs/guides/hardware-sizing.md): Size RAM, CPU and storage for a self-hosted GraphnAI server and Identity Bridge by identity count and estimated edges, from Small to Enterprise.
- [Automated Entra ID Setup: App Registration, Certificate and Admin Consent](https://www.graphnai.com/docs/guides/automated-entraid-setup.md): Walk through the setup wizard that creates GraphnAI's Entra ID app registration and certificate, turns on OIDC sign-in and asks for admin consent.
- [Entra ID (Azure AD) OIDC Setup: App Registration, Graph API Permissions and Admin Consent](https://www.graphnai.com/docs/guides/entra-id-setup.md): Set up OIDC sign-in with Microsoft Entra ID by hand: register an app, add Graph API permissions, grant admin consent and configure GraphnAI.
- [Identity Bridge: Collect Active Directory over LDAPS, Outbound-Only](https://www.graphnai.com/docs/guides/identity-bridge.md): Deploy the Identity Bridge to collect on-premises Active Directory over LDAPS and SMB with outbound-only mTLS, no inbound firewall ports and no VPN.
- [Bridge Configuration & Multi-Domain Management (LDAPS, Service Account, Sync Schedule)](https://www.graphnai.com/docs/guides/bridge-configuration.md): Add Active Directory domains to an Identity Bridge, test the LDAP bind, trust the LDAPS certificate authority and set the sync schedule, all from GraphnAI.
- [Domain Auto-Discovery: Find Domain Controllers with DNS SRV Lookups](https://www.graphnai.com/docs/guides/domain-auto-discovery.md): Find Active Directory domains and domain controllers with a DNS SRV lookup, test LDAPS (636) and LDAP (389), and add them to a bridge.

## Docs: See what’s real
- [Risk Posture Dashboard: Identity Risk Score, Outliers and Tiered Fidelity™ Coverage](https://www.graphnai.com/docs/guides/risk-posture-dashboard.md): Identity risk score from eight factors, with peer-group outliers, Critical Junctions, Tiered Fidelity coverage, trend and Platform Health.
- [Identity Inventory: Risk, Reach, Permissions, Group Membership and Outliers](https://www.graphnai.com/docs/guides/identity-inventory.md): Every identity in one risk-sorted table with reach, permissions, group membership and AdminSDHolder flags, plus peer-group outliers (σ) and graph views.
- [Exposure Risk Factor: Security Posture Findings in the Risk Score](https://www.graphnai.com/docs/guides/exposure-risk-factor.md): How open Security Posture findings, such as Kerberoasting and AS-REP Roasting exposure, set each identity's risk score through the Exposure factor.
- [Graph Explorer](https://www.graphnai.com/docs/guides/graph-explorer.md): Explore your identity graph with edges, shortest paths, trusts and logon sessions, and see a Tiered Fidelity level on every edge.
- [Relationship Detail Drill-Down](https://www.graphnai.com/docs/guides/relationship-detail.md): Open an edge to see its permissions, ACE origin, fidelity level and constraints, and whether each permission was seen in use in your Windows audit events.
- [Change-History Checks](https://www.graphnai.com/docs/guides/change-history-checks.md): Prove a permission went unused by checking an object's replication metadata on every domain controller, and run the check yourself with Check now.
- [Streaming River Rendering and Exact Counts: Blast Radius and Reach Graphs](https://www.graphnai.com/docs/guides/streaming-river-exact-counts.md): Blast radius and permission graphs load hop by hop with exact identity counts at every level, and say plainly when a map is partial.
- [River Drill-Down: List the Identities Behind a Blast Radius Bucket](https://www.graphnai.com/docs/guides/river-drill-down.md): Select a bucket on a river or junction graph and list the identities behind its count, in a table that opens in seconds and loads the whole bucket.
- [Domain & Forest Trusts: SID Filtering and Trust Escalation](https://www.graphnai.com/docs/guides/domain-trusts.md): Review forest, external and within-forest trusts, SID filtering, selective authentication and which trusts let an attacker escalate between domains.
- [Boundary Escape: Hybrid Identity Attack Paths Across Forests and Tenants](https://www.graphnai.com/docs/guides/boundary-escape.md): Find hybrid identity attack paths: identities that escape their forest or Entra ID tenant through sync links or trusts, then investigate or accept them.
- [Critical Junctions](https://www.graphnai.com/docs/guides/critical-junctions.md): Find chokepoints in your identity graph with closeness and betweenness centrality, scored 0 to 10 against attack paths into Critical assets.
- [Asset Criticality Engine: Tier 0 Assets and Shadow Admins](https://www.graphnai.com/docs/guides/asset-criticality.md): Rate identities Low to Critical, find Tier 0 assets and shadow admins through nested groups, and manage built-in and custom criticality rules.
- [Over-Permission Analytics: Find Outliers Against Peer Groups](https://www.graphnai.com/docs/guides/over-permission-analytics.md): Over-permissioned identities as outliers: permission counts more than 2σ (standard deviations) above the peer-group average, set with Detection Sensitivity.
- [Stale Identity Detection: Dormant Accounts and lastLogonTimestamp](https://www.graphnai.com/docs/guides/stale-identity-detection.md): Find stale and dormant accounts past their inactivity threshold from lastLogonTimestamp and lastLogon, with Tier 0 and Critical accounts marked urgent.
- [Dormancy-Aware Risk Prioritization: Disabled Accounts and Dormant Edges](https://www.graphnai.com/docs/guides/dormancy-aware-risk-prioritization.md): How GraphnAI ranks disabled accounts below active ones and prices dormant edges higher on attack paths, without excluding either from counts.
- [NHI Discovery: Non-Human Identities, Service Accounts and Kerberoastable Accounts](https://www.graphnai.com/docs/guides/nhi-discovery.md): Find non-human identities (service accounts, gMSAs, service principals, app registrations) and triage Kerberoastable accounts, expiring credentials and owners.
- [Account Security Checks: Indicators of Exposure (Kerberoasting, AS-REP Roasting, adminCount)](https://www.graphnai.com/docs/guides/account-security-indicators.md): Account security checks for Kerberoasting (T1558.003), AS-REP Roasting (T1558.004), stale adminCount and risky privileged accounts, with a fix for each.
- [Entra ID and Hybrid Checks: Admin Roles, Conditional Access and Hard-Match Takeover](https://www.graphnai.com/docs/guides/entra-hybrid-indicators.md): Twenty posture checks for Microsoft Entra ID: user consent, device code sign-in, Conditional Access, admin roles and hard-match takeover, with a fix for each.
- [Workload Identity Checks: Service Principal Takeover, Credential Backdoors and Illicit Consent](https://www.graphnai.com/docs/guides/workload-identity-checks.md): Thirteen posture checks for Entra service principals, app registrations and service accounts: tenant takeover, credential backdoors, illicit consent and owners.
- [Delegation Risk: Audit Active Directory Delegation (ACEs, GenericAll, WriteDacl)](https://www.graphnai.com/docs/guides/delegation-posture.md): Audit Active Directory delegation ACEs against Microsoft best practices. Find GenericAll, WriteDacl and cross-plane grants, then remove one with undo.
- [Group Policy Security Checks: GPO Edit and Link Rights, cpassword and SYSVOL](https://www.graphnai.com/docs/guides/group-policy-checks.md): GPO security checks for who can edit or link Group Policy, Group Policy Preferences passwords (cpassword) in SYSVOL, and weak NTLM and LLMNR settings.
- [Certificate Services (AD CS): ESC1, ESC3, ESC4, ESC5 and ESC13 Escalation Paths](https://www.graphnai.com/docs/guides/certificate-services.md): AD CS certificate templates and CAs in the graph, with ESC1, ESC3, ESC4, ESC5 and ESC13 escalation paths and two posture checks.
- [Local Administrators: Who Has Local Admin, RDP and PowerShell Remoting](https://www.graphnai.com/docs/guides/local-administrators.md): See who has local administrator rights, RDP or PowerShell Remoting on which computers, which Group Policy grants it, and how well each grant is proven.
- [Cross-Tier Credential Exposure: Tier 0 Credentials at Risk of OS Credential Dumping (T1003)](https://www.graphnai.com/docs/guides/cross-tier-credential-exposure.md): Find computers where a Tier 0 credential sits in memory and a lower-tier account can dump it from LSASS (T1003), using logon events 4624 and 4672.

## Docs: Fix it safely
- [Select Fire™: Blast Radius Simulation and Remediation](https://www.graphnai.com/docs/guides/select-fire.md): Simulate the blast radius of removing a group membership, ACE or permission edge, then run it with undo or get a script. Includes the safety score.
- [Risk Narrative and Gradient of Control: Autonomy Levels for Automated Remediation](https://www.graphnai.com/docs/guides/risk-narrative-gradient-of-control.md): Read why Select Fire recommends each change and how far each automated remediation can run on its own, from Safe Mode to Full-Auto, with blast radius.
- [Remediation Action Catalog: Auto-Remediation Actions for Active Directory and Entra ID](https://www.graphnai.com/docs/guides/remediation-action-catalog.md): Every auto-remediation action Select Fire runs in Active Directory and Entra ID, with userAccountControl flags, the deny list, undo classes and the audit trail.
- [Semi-Auto Execution: Authorize, Run and Undo Remediation](https://www.graphnai.com/docs/guides/semi-auto-execution.md): Semi-Auto automated remediation: authorize each Select Fire action, run it through the Identity Bridge, verify it in the directory, and undo it if needed.
- [Full-Auto Execution: Auto-Remediation Without Per-Action Approval](https://www.graphnai.com/docs/guides/full-auto-execution.md): Full-Auto is GraphnAI's automated remediation (auto-remediation) mode. Arm it and review the deny list, shadow mode report and rollback watches.
- [Remediation Reversibility and Undo: Revert and Roll Back Auto-Remediation Actions](https://www.graphnai.com/docs/guides/remediation-undo-reversibility.md): Check whether an auto-remediation action is reversible before it runs, then revert it with Undo from saved state, including container ACE removals.
- [Closed-Loop Rollback: Automatic Rollback of Auto-Remediation Actions](https://www.graphnai.com/docs/guides/closed-loop-rollback.md): Closed-Loop Rollback watches hosts after a Full-Auto action and rolls it back or escalates it when failed logons or failed services exceed their baseline.
- [Fix Kerberos Delegation Findings (RBCD, Unconstrained Delegation, Shadow Credentials)](https://www.graphnai.com/docs/guides/delegation-remediation.md): Fix RBCD, unconstrained delegation, protocol transition and Shadow Credentials findings, and review the Kerberoasting, Timeroasting and BadSuccessor checks.
- [AD Permission Revocation: Remove an ACE or DCSync Rights](https://www.graphnai.com/docs/guides/ad-permission-revocation.md): Remove one ACE or a DCSync right from an Active Directory object with Select Fire. Simulate the blast radius first, then undo from a saved state.
- [Break-Glass Credential Rotation: KRBTGT, Built-in Administrator and Cross-Tier Exposure](https://www.graphnai.com/docs/guides/break-glass-credential-rotation.md): Rotate the KRBTGT password twice (Golden Ticket), reset the built-in Administrator, and clear cross-tier credential exposure when GraphnAI has no automated fix.

## Docs: Catch attacks
- [Telemetry Pipeline: Windows Security Events and OpenTelemetry Collector Setup](https://www.graphnai.com/docs/guides/telemetry-pipeline.md): Collect Windows security events (4624, 4768, 4769) with an OpenTelemetry Collector and audit policy, and see which edges become Validated.
- [Telemetry-Driven Graph Enrichment: Failed Logons, Behavior Profiles and Credential Exposure](https://www.graphnai.com/docs/guides/telemetry-enrichment.md): Failed logon counts (event 4625), 30-day behavior profiles and Tier 0 credential exposure that domain controller telemetry adds to each identity.
- [Identity Threat Detection & Response (ITDR): Kerberoasting, DCSync and Lateral Movement Detection](https://www.graphnai.com/docs/guides/itdr-detection.md): Detect Kerberoasting, DCSync, brute force, password spray and lateral movement from domain controller events, with MITRE ATT&CK IDs and paths to Tier 0.
- [Detection Alerts: Triage Brute Force, Password Spray, Kerberoasting and DCSync Alerts](https://www.graphnai.com/docs/guides/detection-alerts.md): Triage ITDR alerts for Kerberoasting, password spray, brute force and DCSync, with MITRE ATT&CK IDs, evidence and the paths to Tier 0 for the targeted account.
- [Investigations: AI-Assisted Identity Investigation Reports](https://www.graphnai.com/docs/guides/investigations.md): Run an AI-assisted identity investigation and read the report: peer comparison, logon pattern, MITRE ATT&CK findings and recommended actions.
- [Identity Investigation Timeline: Logon Sessions, Alerts and Events](https://www.graphnai.com/docs/guides/identity-timeline.md): Investigate one identity's logon sessions, detection alerts and telemetry events in time order, with behavior overview, charts and access intelligence.

## Docs: Graphne
- [Multi-Agent Intelligence: Graphne Queries, Finding Explanations and Operational Safety Metric™](https://www.graphnai.com/docs/guides/multi-agent-intelligence.md): Ask Graphne about your identity graph in plain language, get finding explanations, and read the Risk Score and blast radius scoring behind each answer.
- [AI Evidence Trail: Audit Graphne's Model Calls, Tool Calls and Decisions](https://www.graphnai.com/docs/guides/ai-evidence-trail.md): Audit every Graphne run: the model, system prompt, tool calls and graph queries it used, the data it saw, and whether people accepted or rejected its advice.
- [Multi-Provider AI Configuration: LLM Providers, Routing, Failover and Cost Tracking](https://www.graphnai.com/docs/guides/multi-provider-ai-configuration.md): Add LLM providers for Graphne, route tasks with failover and a circuit breaker, set model prices and a monthly budget, and send OpenTelemetry traces.
- [AI Safety Controls: Kill Switch, Tool Access, Least-Privilege Agents and Spending Cap](https://www.graphnai.com/docs/guides/ai-safety-controls.md): Stop running AI work, turn AI off, restrict Graphne tools by role, check each agent's least-privilege access, and set a hard monthly spending ceiling.
- [Decision Models: Prompt Injection Screening with Classifier Probabilities](https://www.graphnai.com/docs/guides/decision-models.md): Screen attacker-written text for prompt injection with decision models, classifiers that give a probability for each answer before AI features read it.
- [Decision Assurance: Calibration, Evidence Checks and Promotion for Decision Questions](https://www.graphnai.com/docs/guides/decision-assurance.md): Check that a decision question is calibrated on your own data, attack-tested and drift-checked before it moves past shadow mode to advisory or automated.
- [Graphne Agent Query Hardening: Read-Only Queries and Prompt Injection Defense](https://www.graphnai.com/docs/guides/graphne-query-hardening.md): How Graphne keeps the queries it writes read-only and bounded, defends against prompt injection, and what happens when a query is refused, truncated or slow.

## Docs: Administer
- [Multi-Provider Platform Authentication & Setup](https://www.graphnai.com/docs/guides/multi-provider-authentication.md): Set up OIDC single sign-on (SSO) to GraphnAI with Entra ID, Okta, Amazon Cognito or any OpenID Connect provider, with invites and just-in-time provisioning.
- [LDAP Authentication: Sign In to GraphnAI with Active Directory (LDAPS)](https://www.graphnai.com/docs/guides/ldap-authentication.md): Sign in to GraphnAI with Active Directory using LDAP search-and-bind over LDAPS, with group-to-role access by SID and optional JIT account provisioning.
- [Managing Sign-In Methods After Setup](https://www.graphnai.com/docs/guides/post-setup-sign-in-methods.md): Add, test, activate, replace and remove OIDC single sign-on (SSO) providers and directory sign-in after setup, from the Identity Providers page.
- [User Management & Role-Based Access Control (RBAC)](https://www.graphnai.com/docs/guides/user-management-rbac.md): Role-based access control (RBAC) in GraphnAI, with the Viewer, Operator and Admin roles, user and group grants, invites and deny-by-default access.
- [Profile & Sessions](https://www.graphnai.com/docs/guides/profile-and-sessions.md): How GraphnAI sessions work, including sign-in duration, the idle timeout, the session policy, signing out devices, and ending any session as an administrator.
- [API Key Management: Scopes and OTel Collector Authentication](https://www.graphnai.com/docs/guides/api-key-management.md): Create domain-scoped API keys for OTel Collector authentication, choose scopes that map to roles, and revoke or rotate keys.
- [Operator Identity Resolution: Matching Sign-Ins to Directory Accounts by objectGUID](https://www.graphnai.com/docs/guides/operator-identity-resolution.md): How GraphnAI matches sign-ins, escalation contacts and service accounts to directory accounts by objectGUID, and why automation waits for a confirmed match.
- [Licensing & Plans](https://www.graphnai.com/docs/guides/licensing-and-plans.md): What each GraphnAI plan includes, how locked features look, how the user count works, and how to apply or renew a license.
- [Preview & License Lifecycle](https://www.graphnai.com/docs/guides/preview-license-lifecycle.md): How the GraphnAI Public Preview license works, including the 30-day trial, read-only mode at expiry, and how to apply or renew a license.
- [License Management & Feature Gating](https://www.graphnai.com/docs/guides/license-enforcement.md): How license enforcement works in GraphnAI, with read-only mode at expiry, feature flags, the identity cap, directory source limits and Prometheus alerts.
- [Real-Time Notifications & Dashboard Updates (Event Bus and Server-Sent Events)](https://www.graphnai.com/docs/guides/event-bus-notifications.md): How GraphnAI pushes live updates to your browser over server-sent events and raises notifications for Critical alerts, risk score jumps and Full-Auto events.
- [Diagnostics: Log Level, Log Search and Support Bundle](https://www.graphnai.com/docs/guides/diagnostics.md): Change the log level, search server and bridge logs, and download a support bundle from Admin > Diagnostics, without shell access to any host.
- [Support Access: Time-Limited, Read-Only Diagnostics for GraphnAI Support](https://www.graphnai.com/docs/guides/support-access.md): Let GraphnAI Support run time-limited, read-only diagnostic queries with a support access key. Admins enable it, everyone sees it, and you can end it at once.
- [Usage Reporting: What GraphnAI Sends and Every Field](https://www.graphnai.com/docs/guides/usage-reporting.md): Every field in GraphnAI's usage report (usage telemetry), the firewall details, how to view today's report, and how to turn reporting off.

## Docs: Reference
- [Security Architecture: Mutual TLS, Encryption, Credential Handling and RBAC](https://www.graphnai.com/docs/guides/security-architecture.md): How GraphnAI secures identity data: outbound-only bridges, mTLS, AES-256-GCM encryption at rest, credential handling, OIDC sign-in and RBAC.
- [Identity Graph Data Model and Change Simulation](https://www.graphnai.com/docs/guides/graph-schema.md): GraphnAI models identities as a graph of nodes and typed edges with Tiered Fidelity levels, and simulates access changes without touching live data.
- [Identity Folding™: Edge Consolidation and Risk Weighting for ACL Permissions](https://www.graphnai.com/docs/guides/edge-consolidation-weighting.md): Identity Folding merges the ACL permissions between two identities into one weighted edge with a severity, so the worst access ranks first.
- [Active Directory Permission Coverage Expansion](https://www.graphnai.com/docs/guides/ad-edge-type-expansion.md): How GraphnAI maps DCSync rights, constrained delegation, RBCD, gMSA password readers, WriteGPLink and AddSelf as graph edges after a full sync.
- [Entra ID Permission Visibility: Graph API Permissions, OAuth Grants, Conditional Access and PIM](https://www.graphnai.com/docs/guides/entra-edge-type-expansion.md): See Entra ID attack paths: abusable Microsoft Graph API permissions, OAuth 2.0 delegated grants, Conditional Access coverage, PIM eligible roles and guests.
- [Entra ID Directory Accuracy: App Registrations, Service Principals and Directory Roles](https://www.graphnai.com/docs/guides/entra-data-model-correctness.md): How GraphnAI links app registrations to service principals, scopes directory role assignments and shows which Entra ID data is collected.
- [Attribute Sync Configuration: Choose LDAP Attributes and Entra ID Properties](https://www.graphnai.com/docs/guides/attribute-sync-configuration.md): Choose which LDAP attributes and Microsoft Graph properties each Active Directory and Entra ID sync collects, including personal data for GDPR.
- [Delta Membership Collection: Group Membership (memberOf, uSNChanged) Between Full Syncs](https://www.graphnai.com/docs/guides/delta-membership-collection.md): How a delta sync picks up Active Directory group membership changes (memberOf, global catalog, range retrieval) and repairs gaps without a full sync.
- [Sync Phase Timeline: Find the Slow Phase of a Sync](https://www.graphnai.com/docs/guides/sync-phase-timeline.md): Read the sync phase timeline: per-phase timing and nested step bars show where a slow sync spends its time, from import to build permissions to analytics.
- [At-Scale Reads: Cursor Pagination, NDJSON Streaming and Denormalized Edge Fields](https://www.graphnai.com/docs/guides/at-scale-reads.md): How GraphnAI keeps large reads fast, with cursor pagination, streamed reach data and explicit cap fields.

## Company
- [About](https://www.graphnai.com/about.md)
- [Careers](https://www.graphnai.com/careers.md)
- [Press](https://www.graphnai.com/press.md)
- [Contact](https://www.graphnai.com/contact.md)