Adversary Attack Techniques
Our audit processes simulate attack techniques that threat actors would use either to attempt to gain initial access or once they have a foothold into your organisation and are pivoting around the network.
Password Audit
When your primary authentication mechanism for your customers, users and admins to access your systems is a username/password combo, you need to ensure they are all choosing good strong passwords (or even better passphrases).
By auditing your passwords, you can gain insights into what common mistakes are being made, and what next steps you can take to educate, prevent and ensure your users are protected.
Your password audit covers:
- Utilising the latest attack techniques to be able recover passwords
- Highlighting privileged accounts that would be easy to compromise
- Determining passwords that have previously appeared in data breaches
- Pinpointing password resuse across accounts or domains
- Identifying accounts that have never been logged into or passwords that have long since expired
- Comparing recovered passwords against company policy and best practices
- Reviewing passwords for common themes and insights
- A report detailing next steps to improve your security posture
Key Features
Common or custom stores
Audit Active Directory, Entra ID (Azure AD) or any custom password stores
Compliance reporting
Reporting available for demonstrating compliance (e.g. PCI DSS, SWIFT)
Policy adherence for accounts
Analyse privileged account passwords and determine password policy adherence
Reuse, expired and dormant accounts
Find password reuse, expired passwords and dormant accounts across domains
Analyse past data breaches
Identify passwords from previous data breaches
Identify risks to the business
Identifies risks for the business and where controls should be implemented
Ensure your passwords make it difficult for an attacker
Audit your passwords to gain insights into what common mistakes are being made, and what next steps you can take to educate, prevent and ensure your users are protected.
