Active Directory exposure management — from assessment to client deliverable in one command.

ADscan

Active Directory exposure management for pentesters, MSSPs, and CISOs.

One command runs the assessment. On an engagement workspace it writes the client report by itself. No tool-hopping.

Current version: 10.1.0 LITE

Three tiers

Tier	What it is	Who uses it
LITE	Free CLI engine — community-maintained scan core	Pentesters, red teamers, students
PRO	LITE plus the Client Deliverable Kit — three PDFs, the ATT&CK Navigator bundle, and a ZIP	MSSPs, consultancies billing engagements
Enterprise	Continuous CTEM/BAS web service with weekly digest	CISOs operating their own AD posture

LITE quickstart — install, scan, attack-paths in under 10 minutes.

PRO setup — generate the Client Deliverable Kit in 90 seconds.

Architecture, deployment model, and what the kit looks like.

Active Directory enumeration — DNS, LDAP, SMB, Kerberos, ADCS, trust spidering, native graph collection.
Attack execution — Kerberoasting, AS-REP roasting, ACL abuse, GPP, GPO abuse, constrained-delegation SPN-jacking (SPNJack), DCSync, ADCS ESC1-16.
A report you did not ask for — on an audit workspace, ADscan writes a client-ready exposure report (HTML and PDF) the moment the scan finishes. Free tier, no command. It carries the posture score, the findings, the validated attack paths with each step's honest status, the choke-point ranking, and a disclosure of every change ADscan made to the directory.
Client Deliverable Kit (PRO) — Security Assessment Report, AD Hardening Playbook, AD Control Coverage Report, plus the interactive MITRE ATT&CK Navigator bundle, generated in about 90 seconds with adscan deliver.