Security and Data Handling
Security
What leaves your network and what never does
The scanner reads your Active Directory configuration and sends that metadata to our portal, which builds your report from it. Password hashes, Kerberos tickets and your NTDS.dit never leave your network.
At a glance
Scan
Read-only, as a standard domain user
Stored in
Microsoft Azure, East US 2
Encryption
In transit and at rest
Sign-in
Two-factor authentication on every plan
Audits
SOC 2 Type 1 complete, Type 2 underway
Deletion
Any time from your account. Closed accounts are cleared within 30 days.
Our Trust Center carries the Breach Point name because Breach Point builds Insight Recon.
Configuration goes up and credentials stay home
SentTo the portal
- Object attributes, like account flags, service principal names and when a password was last set
- Group memberships and who holds rights over sensitive objects
- Group Policy and certificate services configuration
- Hardening settings from your domain controllers and AD servers, like SMB signing and PowerShell logging
- Trusts plus domain and forest settings
- On paid plans, the on-prem objects behind Entra Connect, like the sync account and AZUREADSSOACC$
Never sentStays on your network
- Passwords and password hashes
- Kerberos keys and tickets
- Your NTDS.dit database
- Anything from your Entra ID tenant. We don't scan it.
The sample report shows exactly what the portal builds from that metadata.
Where it lives
Who can see your scan data
Storage
Microsoft Azure, East US 2
Your scan data is encrypted in transit and at rest.
Your team
You decide who gets in
Two-factor sign-in comes with every plan. Paid plans add role-based access. Enterprise and MSSP include SSO and IP allowlisting. Auditor can add them as a quoted option.
Our team
Need-to-know only
Only Breach Point employees whose job needs it can see your scan data.
How we use it
Your report, plus anonymized benchmarks
We use it to build your report and run the service. We don't sell your results or share them for marketing.
Our monthly AD Signal benchmarks use anonymized numbers across many environments. They never identify a customer or an environment.
Free plan
We keep your latest scan.
Paid plans
We keep your scan history while you subscribe, which lets you track changes over time.
Deleting it
Export or delete your scan data from your account whenever you want. Close your account and it's cleared within 30 days. Backup copies roll off on their normal schedule.
The legal version lives in our Privacy Policy and the EULA.
A read-only scan from one machine
The scanner reads AD, Group Policy and server hardening settings, and never creates, changes or deletes anything.
How scanning works- No Domain Admin. A standard domain user is all it needs. We'd rather you didn't use Domain Admin for it.
- Nothing on your domain controllers. The portable scanner runs from one machine you pick, domain-joined or not. On Standard, Enterprise and MSSP, you can install the Windows agent on that machine to run scans on a schedule.
- It can set off alerts. A burst of LDAP, SMB and Remote Registry reads plus DNS zone transfer attempts looks like reconnaissance to some security tools. Give whoever watches your alerts a heads-up before you run it.
- It's visible in your logs. If you audit LDAP queries, file shares or remote registry access, the scan shows up under the account that ran it.
Every connection it makes
Every one of these is a read. The scanner signs in as the account you run it under, with Kerberos or NTLM, whichever your domain negotiates.
Connection
Port
What it's for
LDAP and LDAPS
389, 636
Accounts, groups, permissions, trusts, delegation and certificate templates
Global catalog
3268, 3269
Lookups across the domains in your forest
Kerberos
88, TCP and UDP
Signing in to your domain controllers when your domain uses Kerberos
SMB
445
Group Policy files in SYSVOL and who can change them. It's also the backup route for Remote Registry.
Remote Registry
135 + dynamic RPC (WMI), or 445
Hardening settings on domain controllers, certificate authorities and WSUS servers, like SMB signing, PowerShell logging and hardened UNC paths
DNS
53, UDP and TCP
Finding your domain controllers, plus zone transfer attempts to see whether anyone can pull your zones
HTTP and HTTPS
80, 443
Checking each certificate authority's /certsrv web enrollment page for NTLM relay. That's ESC8.
HTTPS checks
443, 8530, 8531
Whether management endpoints like WSUS use HTTPS and a valid certificate
HTTPS out
443
The encrypted upload to our portal. It's the only connection that leaves your network.
A few checks, like Net Session Enumeration Allowed, also read settings from member computers.
Air-gapped
Can't send anything out? Run it inside your network.
On Enterprise and our partner plans, Insight Recon can run on a server inside your network. Scans, the database and the reports all stay there. We quote it per project and waive the one-time deployment on a 3-year agreement.
- We ship it as a VM image you bring in through your own transfer process.
- Each domain's scanner reaches the server on outbound TCP 443. The server never connects back.
- New checks and updates arrive as signed offline files.
- Scans still run as a standard domain user, with nothing installed on your domain controllers.
For your security review
The paperwork
SOC 2
Type 1 done, Type 2 underway
We've completed our SOC 2 Type 1 audit. We're in the Type 2 audit period now, with the same auditor. Want a copy of the report? Ask us.
Trust Center
Policies and subprocessors
Our subprocessors are Microsoft Azure, Office 365 and Cloudflare. The Trust Center keeps the current list along with our controls and policies. Need a data processing addendum? Ask us.
Procurement
Vendor setup
We invoice on net 30 terms and have a W-9 ready for your vendor setup. You can also buy through SHI or another reseller at the same list price.
Found a bug?
Report it to us
Email [email protected]. Our vulnerability disclosure program covers what's in scope. We usually reply within 24 hours.
What security teams ask us
Does the scan run any exploits?
No. It doesn't attempt exploitation, credential attacks or lateral movement. It reads your configuration and stops there.
What does the scanner machine need to reach?
Your domain controllers over LDAP or LDAPS, the global catalog, Kerberos, SMB, RPC and DNS, plus your certificate authorities and WSUS servers if you have them. A few checks, like Net Session Enumeration Allowed, also read settings from member computers. Outside your network, it only reaches our portal over HTTPS to upload the results. Nothing else on your network has to talk to us. Every port is listed above.
Does Insight Recon scan Entra ID?
No. Our hybrid identity checks look at what Entra Connect leaves in your on-prem AD, like the sync account and AZUREADSSOACC$. We never connect to your tenant.
Who's behind Insight Recon?
Breach Point, a security company in Richmond, Virginia. We built Insight Recon after years of running into the same Active Directory problems on pentests. Meet the team.
Read the report before you decide
Scan one domain for free and look at exactly what the portal builds from your metadata.