# Active Directory Security Assessment

> From $40K · Offensive Security · https://cisomarketplace.services/services/active-directory-assessment

Comprehensive security assessment of Active Directory infrastructure, focusing on privilege escalation, lateral movement, and domain compromise scenarios.

## In scope

- Domain security assessment
- Trust relationship analysis
- Privilege escalation testing
- Password policy evaluation
- Group policy security review

## Deliverables

- Domain security report
- Attack path analysis
- Privilege escalation findings
- Security policy recommendations
- Hardening guidelines

## Tiers

### Core AD Security Assessment: $40K

Assessment of 1 AD forest with 1 domain, up to 2,500 users: password and group policy review, privileged group analysis, and privilege-escalation testing from 1 standard-user starting point.

Limits: domains 1, users 2500

Includes:
- 1 forest, 1 domain, up to 2,500 users
- Password policy and GPO security review
- Privileged group and delegation analysis
- Privilege-escalation testing from 1 standard account
- Hardening guidelines

Excludes:
- Trust relationship analysis
- Full attack-path mapping to domain compromise
- Cloud identity (hybrid) review
- Hardening implementation and retest

### Advanced AD Security Program: $70K

Assessment of up to 5 domains in up to 2 forests, up to 10,000 users: full attack-path mapping to domain compromise, trust relationship analysis, lateral movement testing and review of every GPO.

Limits: domains 5, users 10000

Includes:
- Up to 5 domains, up to 2 forests, up to 10,000 users
- Attack-path mapping to domain compromise
- Trust relationship analysis
- Lateral movement testing
- Review of all group policies

Excludes:
- Hardening implementation
- Retest after remediation
- Custom attack tooling
- Tiered administration redesign

### Enterprise AD Security Solution: $110K

Multi-forest AD program; no fixed domain or user cap - scoped at kickoff. Adds custom attack tooling for your environment, tiered-administration design, hands-on hardening support and a full retest after remediation.

Includes:
- All forests and domains, scoped at kickoff
- Custom attack tooling and scenarios
- Tiered administration and hardening design
- Hands-on hardening support
- Full retest after remediation

Excludes:
- Ongoing AD monitoring
- Identity product licences
- Migration or domain consolidation work

## Terms

Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW.

Scope this engagement: https://cisomarketplace.services/scope?service=active-directory-assessment