CyberGuard Assessment Tool
Automated assessments for Active Directory, Microsoft Entra, Microsoft 365, network and compliance: a score from 0 to 100, the paths an attacker can follow and what to fix first.
The solution
CyberGuard Assessment Tool helps organizations assess their Microsoft infrastructure, with a complete view of security, compliance, governance and configuration that goes beyond checking each native console one by one.
It is a web platform that analyzes Active Directory, Microsoft Entra, Microsoft 365, the corporate network and Microsoft Defender data, and connects them. Every check that finds a problem becomes a finding with severity, CVSS score and recommended remediation; findings combine into attack paths and count toward a Security Score from 0 to 100.
Alongside the technical assessments you get compliance questionnaires for NIS2, DORA, GDPR, the AI Act and ISO 27001, the team's work log and PDF reports: everything you need to analyze, fix and prove your security posture from a single interface.
The starting point is always the same: a score for each technology, the list of open issues with their remediation, and a dashboard that tells you what needs attention today.
The Security Score brings together the latest Active Directory, Microsoft Entra and Microsoft 365 assessments. For each one you see the score, the risk level and how many critical, high and medium findings are open.
Every issue detected is a finding: what was found, which objects are affected, the CVSS score and the recommended fix. One list for all technologies, filterable by severity, category and status.
Each technology is split into its own areas — Password Policy, Kerberos and Account Hygiene for Active Directory; Conditional Access and Privileged Access for Entra; Exchange Online and Teams for Microsoft 365 — each rated from 0 to 10.
The first page after sign-in collects your alerts: missing configuration, deadlines to manage, ransomware attacks in your sector and DDoS attacks on your websites in the last 7 days, and team activities stalled for too long. A single indicator summarizes your assessments, split by Active Directory, Microsoft Entra and Microsoft 365.
The threat landscape from public threat intelligence sources, over the last 7, 30 or 60 days: six indicators that show what each number is made of, the period's events with those that concern you at the top, exploited vulnerabilities and newly published critical CVEs, threat groups, campaigns, MITRE ATT&CK techniques, ransomware victims, DDoS targets, IOCs and cloud service status.
Every assessment stays in the history with its date and score. The PDF report, in Italian or English, contains the score, findings, action plan and accepted risks; the collected lists can be exported to CSV.
On-premises and cloud identities, collaboration, devices, network, Microsoft Defender data and regulatory requirements usually live in separate consoles and spreadsheets. CyberGuard puts them side by side: from the finding to the attack path, from the remediation to the proof it worked, all the way to the documentation for a NIS2 audit. It is where your company governs security and compliance.
Attackers chain weaknesses together. CyberGuard builds attack paths from open findings: from a domain user to Domain Admin, from a compromised identity to Global Administrator, from on-premises AD to the cloud, all the way to Microsoft 365 mail and files.
Mark a step's objects as fixed and see which paths break. The simulation saves nothing and changes nothing: it helps you pick the fix with the biggest impact.
Compare two assessments of the same technology: new risks, resolved findings, worsened findings and new checks. It is the proof that the remediation work paid off, ready for periodic review.
When a finding cannot be fixed, an administrator can accept the risk by stating the reason and compensating controls for 30, 90, 180 or 365 days. The score does not change, the report lists it separately and when it expires the finding reopens.
Microsoft Defender XDR incidents and alerts from the last 30 days, ordered by MITRE ATT&CK tactic, with full details for each incident: alerts, involved entities, actions recommended by Microsoft and timeline. Software vulnerabilities with public exploits detected by Defender on your devices, with those actively exploited and used by ransomware at the top. Read-only.
Run KQL Advanced Hunting queries on Microsoft Defender XDR and Microsoft Sentinel data directly from CyberGuard, read-only. A catalog of queries curated by Inside Technologies and mapped to MITRE ATT&CK is ready to use.
The Workspace records what the team has done: how an incident was handled, the decision on a finding, investigation notes, queries worth keeping. Every activity has an author, an owner and a status, and stays linked to the data it refers to.
Schedule assessments daily, every N days or weekly: the Security Score stays up to date without anyone having to remember it, and notifications come from your own mail server.
The Active Directory assessment analyzes on-premises domains: how they are built, how healthy the domain controllers are, which accounts and permissions expose them, and how well Kerberos, DNS and Active Directory Certificate Services are protected.
Functional levels, last Active Directory backup, forest domains and trusts. For each domain controller: reachability, uptime and pending restarts, time source, memory, CPU and disks, AD services, database size and LDAPS certificate.
Password policy, account hygiene, privileged accounts and exposed credentials. On the Kerberos side: unconstrained delegation, Kerberoastable and AS-REP roastable accounts, weak encryption such as RC4 and KRBTGT password age.
The security settings of every domain controller: network protections, NTLMv1, LDAP signing and channel binding, anonymous LDAP, Print Spooler, audit policy. For AD-integrated DNS: dynamic updates, who can create records (ADIDNS), WPAD and wildcard records, forwarders and zone transfers.
Who holds dangerous rights on the domain root and on Tier 0 objects, who can run DCSync, and which Group Policies and SYSVOL scripts expose the domain. Permissions that open an attack path link directly to the map.
Users and computers that have not signed in for months, disabled accounts never removed, objects and SIDs orphaned by deletions and migrations: the attack surface that grows silently, with the list of objects to clean up.
An interactive map of the forest, sites and domain controllers with FSMO roles, Global Catalog and RODCs. The replication matrix shows the status between every pair of DCs and the leftovers to clean up: decommissioned DCs, sites without subnets and the like.
Exposure to critical vulnerabilities and the updates installed on each domain controller; network shares published by domain servers, with their paths, searchable by server.
The Microsoft Entra assessment analyzes your cloud identity tenant: users and groups, applications and permissions, privileged roles, Conditional Access and the signs that someone may already be abusing your identities.
Users, groups, registered devices and Microsoft Secure Score at the top of the page; below, device settings, user and admin consent, inactive users and guests with the licenses they still consume.
Instead of making you read every policy, CyberGuard checks whether the protections that matter are really there: MFA for everyone and for administrators, blocking of legacy authentication and device code flow, Token Protection, risk-based policies.
Who holds administrative roles and how: permanent assignments or through Privileged Identity Management, MFA registration per user, security defaults and password expiration. Administrators without MFA immediately become a finding.
Enterprise applications and app registrations, expiring or expired secrets and certificates, consents granted to third-party applications with the risky ones highlighted. Apps with privileged application permissions are a direct route to Global Administrator.
While the rest of the assessment looks at configuration, Eagle Eye looks at what happened: Entra ID Protection risk detections and the changes typical of someone trying to keep access to the tenant, such as secrets added to apps, consents and new role members.
Sync method, last sync, federation, Seamless SSO key and admins synced from on-premises, who should be cloud-only. If you also run the AD assessment, CyberGuard shows the paths that lead from a compromised domain to Global Administrator.
The Microsoft 365 assessment analyzes how your collaboration environment is configured: Exchange Online mail, SharePoint and OneDrive sharing, Teams, data protection with Purview, Intune devices, Copilot Studio agents and Microsoft Defender. Sections not covered by your licenses are flagged, not left blank.
Mailboxes, shared mailboxes, SharePoint sites and teams; Microsoft 365 group settings, Secure Score, Office Store and trials. Assessment progress is shown service by service.
Mailboxes and shared mailboxes with sign-in enabled, connectors and transport rules, mail flow and protection settings, calendar sharing, domains, auditing and logging. Configurations that make mail exfiltration easier become findings.
SharePoint and OneDrive external sharing settings, resharing by guests, domain restrictions and legacy protocols, along with the list of sites: where files can leave your organization.
Guest access, message security, allowed apps, meetings and lobby, external file providers, Copilot and AI in meetings, voice and face recognition, and governance of Copilot Studio agents.
Data Loss Prevention policies and rules, retention policies, sensitivity labels and mailbox audit bypass. The data protection that NIS2 and GDPR require you to prove, verified against your actual configuration.
How many devices you manage, the share that are compliant, the noncompliant ones and those not synced for more than 30 days, with operating system, compliance status and days since last sync. Plus configuration profiles and their assignments.
Microsoft Defender for Identity sensors and their health issues, Defender for Office 365 policies: anti-phishing, anti-spam, anti-malware, Safe Links and Safe Attachments, Tenant Allow/Block List.
Technical assessments tell you how systems are configured. Regulations ask for more: processes, roles and controls. CyberGuard turns legal text into concrete questions, one regulation at a time, and returns a readiness report area by area. It is an indicative evaluation: it does not replace legal advice or a certified audit.
Guided questionnaires for NIS2, NIS2 Italy with the obligations of the Italian National Cybersecurity Agency (ACN), DORA, GDPR, AI Act, ISO/IEC 27001 and ISO 9001. Each card shows scope, number of questions and last update date.
First, a few questions to establish whether and how the regulation applies to you; then questions grouped by area — systems management, incidents, personnel security, suppliers — answered No, Partial or Yes; finally the readiness level and the gaps to close.
You don't need to know the regulation by heart. Under each question you will find what No, Partial and Yes mean in practice, the article the question comes from and the requirements it sets. Every gap in the report stays tied to the legal text.
Legal texts, authority guidelines, FAQs and reference documents, filterable by regulation and type. For NIS2 in Italy, CyberGuard monitors ACN publications and flags the sources that have recently changed.
Many requirements — access control, MFA, logging, backup, vulnerability management — are verified in practice by the Active Directory, Microsoft Entra and Microsoft 365 assessments. Planned actions are recorded in the Workspace, Compliance area.
Network Assessment completes the picture with the devices that aren't in Active Directory or Intune: switches, firewalls, access points, printers, NAS, cameras, hypervisors. It finds every device that responds, the services it exposes and the vulnerabilities in its firmware.
Devices found, active and at risk, CVE vulnerabilities; trends over time and the highest-risk devices. Charts by type, vendor and site, scan coverage and most exposed ports.
What was detected — name, IP and MAC, vendor, model, firmware, operating system, first and last seen — plus operator management: correct type, site and notes.
For each device, CyberGuard identifies the vendor, model and firmware version and keeps only the public CVEs whose vulnerable version range actually includes that firmware. Every scan reconfirms the result.
CyberGuard detects open ports and analyzes the services behind them: protocols, web admin interfaces, TLS certificates and their expiration. Misconfigured services become network findings.
Misconfigured services and exposures become findings with severity and remediation, and count toward the Security Score along with those from Active Directory, Microsoft Entra and Microsoft 365.
And more
For each assessment, a report with score, findings, action plan and accepted risks, ready for the customer or the audit. CSV export of all lists.
Granular permissions by user and group: who can view, run, export or administer.
Completed or failed scheduled assessments and the weekly Workspace summary: emails are sent from your own mail server.
Who did what in the portal and when, including changes to users and permissions, with filters by period, object, action and customer.
Plans
Annual pricing, excluding VAT.
No cost
€1,000 / year
€2,500 / year
Everything in Basic, plus:
On request
Everything in Advanced, plus:
Network device inventory, exposed services, firmware vulnerabilities and network findings.
Paid add-on, available per customer for the Advanced and Enterprise plans.
Frequently asked questions
On Microsoft Azure, in data centers in Italy (Italy North region).
On-premises Active Directory, Microsoft Entra and Microsoft 365: Exchange Online, SharePoint, OneDrive, Teams, Purview, Intune and Defender. With the Network Assessment add-on it also analyzes network devices such as switches, firewalls, access points, printers and NAS.
Every check that finds a problem becomes a finding with severity, CVSS score and recommended remediation. Findings count toward a score from 0 to 100 for each technology, with a rating from 0 to 10 for each area, so you can see right away where the score drops and what to fix first.
No. CyberGuard agents only read: they never change the configuration of your domain or tenant. The remediation simulation changes nothing either, and Microsoft Defender data and KQL queries are read-only.
Request a guided demo or talk to our team.
Request a demo