Most people shopping for PingCastle alternatives want to know one of two things. Can my company keep using the free edition? And if we move on, what should the next tool do better? The license question comes first, because the answer might mean you don't need to switch.
What Netwrix's own pages say
For your own company's AD, yes, even at a for-profit company. The license section of PingCastle's GitHub README says "Organizations may use PingCastle internally without purchasing a license, even in for-profit companies." PingCastle's services page adds that the free edition comes without support.
For client work, no. Consultants, pentesters and MSSPs who assess other organizations need PingCastle for Service Providers. It's listed from $1,000 per assessment. Building PingCastle into something you sell takes a separate commercial license.
If the license works for you and the free report covers what you need, keep PingCastle. The PingCastle alternatives below are for everyone else.
List prices from each vendor's own pages or marketplace listings, checked October 30, 2026. Every vendor counts differently, so check the unit next to each price before you compare.
After ours, these PingCastle alternatives run in the order we'd suggest them, starting with tools that do the same job.
01
Insight Recon
by us, Breach Point
Our productFree plan
It's first because this is our page. Hold it to the same standard as the other six.
Best for: teams who want to know what to fix first and exactly how, plus consultants who want a per-client price.
- How it runs
- Portable Windows scanner as a standard domain user. Nothing installed on DCs.
- Checks
- 155+, each one picked on purpose. AD CS from ESC1 through ESC17, apart from ESC12.
- Covers
- On-prem AD and AD CS. Hybrid checks on what Entra Connect leaves in AD come with paid plans.
- Free plan
- One domain per company with every core AD finding. Not for paid client work.
This is a tool built by hackers. On client jobs the other AD tools we ran would hand over a long list of findings with nothing on what to prioritize and little help with remediation. We took care of all of that.
Every one of the 155+ checks is there on purpose. If a check would only add noise, we leave it out.
We set severity by looking at what each finding actually reaches in your domain. Take the replication rights Entra Connect needs for password hash sync. Each account that holds them can read every password hash in the domain.
Replication rights on sync accounts
The one account Entra Connect syncs withExpected
A second one left over from an old installHigh
Then the report tells you where to start. Quick Wins pulls out the fixes with the most impact for the least work and the Top 10 lists your riskiest findings. Paid plans also give every account a risk score. That score comes from the findings it shows up in, how serious they are and the privilege chain that gets it into a group like Domain Admins. The accounts with the highest scores are the ones to lock down first. Open one and its chain sits next to every finding it's tied to.
Each finding starts with the accounts or objects it affects. Hacker Insight explains what we'd do with it on a pentest. After that come the prerequisites and the fix as PowerShell or GUI steps, with a bulk script you can test with -WhatIf. You also get a validation step to prove it worked, plus what to do about exceptions and what evidence to keep.
There's also an inventory of the domain in the report, with CSV export on the tables.
- Every account, its last logon and its password age
- Computers, DCs and stale machines
- Members of every privileged group
- Every GPO and your password policies
- Certificate authorities and templates
- Your Entra Connect setup
We're proud of the report. The score and executive summary up top are written for leadership. The findings map to seven frameworks, from MITRE ATT&CK to DISA STIG, which keeps auditors happy. The sample report has all 92 findings from our test domain if you want to click through them.
Free gets you one domain per company with every core AD finding, no credit card needed. The hybrid checks start at Standard, which is $10 per enabled account a year up to 1,000 accounts with a $3,000 minimum. It covers every domain you own and adds Account Risk Scores, scan history and scheduled scans. You also get remediation tracking and new-finding alerts. Paid client work goes through the Auditor plan instead, at $350 per client assessment.
Good at
- Severity weighed against what each finding touches
- The fix, a validation step and the evidence on every finding
- Published per-assessment pricing for consultants, with white-label reports
Watch for
- Doesn't scan the Entra ID tenant or Okta
- No real-time monitoring or attack alerts. It's an assessment tool.
- Results go to our portal in Azure unless you buy the air-gapped install on Enterprise or a partner plan
Insight Recon vs PingCastle, head to head · How a scan works · Pricing
02
Purple Knight
by Semperis
FreeAD, Entra ID, Okta
Best for: a free second opinion on the same domain, with Entra ID and Okta in the same run.
- How it runs
- Installed Windows software. No elevated AD rights needed.
- Free option
- Yes, after a request form. The link comes by email.
- Public price
- Free. We found no paid Purple Knight tier.
- Covers
- AD, Entra ID and Okta, with 218+ indicators of exposure and compromise
Purple Knight is the closest straight swap. It's free and one run covers AD, Entra ID and Okta. Semperis calls it a point-in-time assessment and sells DSP for continuous monitoring. If you do client work, read the license first. Semperis's website terms say its products fall under a separate agreement that we couldn't find published.
Good at
- Indicators of compromise as well as exposure
- A polished report, rated 4.7 out of 5 on G2 from 11 reviews
Watch for
- Point-in-time by design
- Entra ID scanning needs an app registration with admin-consented Graph permissions
Purple Knight alternatives, our other roundup · Insight Recon vs Purple Knight
03
Netwrix 1Secure ITDR
by Netwrix
SaaSFree trial
Best for: smaller teams that like PingCastle's checks and want them hosted with alerts, at a published price.
- How it runs
- SaaS, hosted by Netwrix in Azure
- Free option
- Free trial
- Public price
- $17, $27 or $34 per enabled AD user plus cloud-only Entra user a year
- Covers
- AD and Entra ID, on PingCastle's assessment engine
This is Netwrix's own hosted take on PingCastle. Netwrix says PingCastle's engine powers more than 200 checks inside 1Secure. The ITDR editions add activity monitoring, alerting and AI remediation guidance. The minimum term is a year. Self-service checkout stops at 150 employees or 250 accounts, so bigger shops end up talking to sales anyway.
Good at
- Published per-user prices and a free trial
- Monitoring and alerts next to the assessment
Watch for
- Community support only for self-service buyers
- The MSP edition's page just says "Request pricing"
Netwrix: 1Secure ITDR pricing · Netwrix: 1Secure for MSPs
04
BloodHound CE and Enterprise
by SpecterOps
Free CEApache-2.0
Best for: seeing the attack paths to Domain Admin and other Tier Zero assets as a graph you can query.
- How it runs
- CE is a web app you host, fed by SharpHound and AzureHound. Enterprise is SaaS or on-prem.
- Free option
- Community Edition, Apache-2.0 license
- Public price
- Enterprise from $30.90 per employee a year, $77,250 minimum, on AWS Marketplace
- Covers
- AD and Entra ID. Okta, GitHub and Jamf through OpenGraph collectors, built into Enterprise and a manual install on CE.
BloodHound answers a different question than PingCastle. A health check grades your configuration, while BloodHound shows the routes an attacker could take to Tier Zero. The two pair well. CE is free and ships often. You'll have to host it and feed it data yourself. Enterprise runs continuously, from $77,250 a year at list.
Good at
- Attack paths and choke points on the way to Tier Zero
- A free, permissive license for CE
Watch for
- It's a graph you explore, with no scored list of misconfigurations
- Some features are Enterprise-only
Insight Recon vs BloodHound · BloodHound CE on GitHub
05
Locksmith 2
by Jake Hildreth
FreeAD CS only
Best for: going deep on AD Certificate Services, with scripts to fix what it finds.
- How it runs
- PowerShell module from the PowerShell Gallery. Works from machines that aren't domain-joined.
- Free option
- Yes, the whole tool
- Public price
- Free, under the MIT license plus the Commons Clause
- Covers
- AD Certificate Services only
Locksmith 2 does one job well. It scans AD CS for 13 ESC techniques between ESC1 and ESC16 and writes remediation scripts for what it finds. Consultants should read the license first. The Commons Clause rules out paid services whose value comes "entirely or substantially" from the tool.
Good at
- Remediation scripts you can review and run
- An HTML dashboard that exports to CSV, Excel or PDF
Watch for
- AD CS only, so you still need a full AD assessment
- Fix scripts change your PKI, so test them first
Locksmith 2 on GitHub · Our post on weak certificate mappings
06
Tenable Identity Exposure
by Tenable
Quote onlyAD and Entra ID
Best for: security teams that want AD and Entra ID watched around the clock, especially if they already run Tenable One.
- How it runs
- SaaS with a Secure Relay on your Windows server, or on-prem on your own VMs
- Free option
- None found. Demo only.
- Public price
- Not published. Licensed per enabled user in AD and Entra ID.
- Covers
- AD and Entra ID. 113 indicators of exposure and 17 of attack.
Pick this when a scan every so often isn't enough. Tenable tracks AD changes as they happen and alerts on attacks like DCSync, Golden Ticket and Zerologon. It also covers the Entra ID tenant and feeds Tenable One. The trade-off is footprint and price. Attack detection pushes a listener to every DC through a GPO. Pricing is quote only. Tenable now calls it Tenable One Identity Exposure, though you may know it as Tenable.ad.
Good at
- Alerts while an attack is happening
- Attack path views
Watch for
- No public price or free trial we could find
- Optional password analysis needs DCSync-level rights
Insight Recon vs Tenable Identity Exposure · Tenable: Identity Exposure
07
Microsoft Defender for Identity
by Microsoft
In E5 and Defender Suite
Best for: organizations already licensed for E5 or the Defender Suite that want attack alerts on their DCs.
- How it runs
- A sensor on every DC, plus AD CS, AD FS and Entra Connect servers for some checks
- Free option
- No. It needs an MDI license.
- Public price
- In Microsoft 365 E5, or the Defender Suite at $12 per user a month on top of Microsoft 365 E3
- Covers
- AD and hybrid posture, with attack alerts for AD, Entra ID and Okta
If you already pay for E5 or the Defender Suite, you own this and you should turn it on. It's detection first, with alerts on attacks like DCSync, golden tickets and Kerberoasting. Its posture recommendations land in Secure Score. Whether that replaces a PingCastle-style assessment is a separate question. Its AD CS checks cover nine ESC numbers, two of them in preview. We couldn't find framework mappings on its posture checks.
Good at
- Real-time alerts across AD, Entra ID and Okta
- Posture statuses refresh daily with no scans to schedule
Watch for
- Sensors need Microsoft's cloud, with no documented offline mode
- No license we could find for a consultant's one-off client assessment
Insight Recon vs Defender for Identity · Microsoft Learn: posture assessments
A free check of your own AD
PingCastle's free edition is allowed for this. Semperis says Purple Knight is free. Our free plan gives you every core AD finding for one domain, each with its fix. All three read AD without changing it, so run two or three on the same domain and look hard wherever they disagree. If AD CS worries you most, add Locksmith 2.
Paid assessments for clients
Don't bill clients for a free edition unless its license allows it. Ours doesn't. PingCastle needs Service Providers, listed from $1,000 per assessment. Each assessment is good for two weeks on specific domains. Our Auditor plan is $350 per client assessment with no minimum. You get 60 days on the client's domain, long enough to rescan after the fixes. That's less than PingCastle's starting price whenever a client has one or two domains. The head-to-head page has the math.
Someone watching around the clock
You're after identity threat detection, which a scanner like ours doesn't do. On E5 or the Defender Suite, turn on Defender for Identity. If you already run Tenable One, look at Tenable Identity Exposure. Keep a scheduled assessment next to either one for the full list of misconfigurations and how to fix them.
The paths to Domain Admin
Use BloodHound. CE is free and maps the attack paths to Tier Zero as a graph you can query. Our paid plans show each account's privilege chain next to its risk score, without the graph or the queries. Our BloodHound comparison shows where each one fits.
Entra ID matters as much as AD
For the tenant itself, look at PingCastle Enterprise with its 102 Entra ID checks, Purple Knight or Tenable. We don't scan the tenant. Our paid hybrid checks cover what Entra Connect leaves in on-prem AD, like sync accounts, AZUREADSSOACC$ and Cloud Kerberos Trust. Our hybrid identity post explains why that side matters.
Scheduled scans and history
PingCastle Enterprise adds built-in scheduled scans and risk remediation tracking, listed from $30 per identity a year. You can run the free build from Windows Task Scheduler and compare the reports yourself. Our Standard plan covers every domain you own and tracks who owns each fix. Each rescan marks every finding new, modified or remediated, then emails you the new ones.
Do I need a paid PingCastle license to assess clients?
Yes. PingCastle's services page says "If you are using PingCastle to audit other organizations, you must purchase a license." That's PingCastle for Service Providers, listed from $1,000 per assessment. Netwrix's docs say each license is good for two weeks on specific domains and forests. Our Auditor plan prices it per assessment instead, at $350 for 60 days on one client domain.
What does the free PingCastle report leave out?
Several sections print "This feature is reserved for customers who have purchased a license." The maturity level and the MITRE ATT&CK section are two of them. So are the password age and last logon distributions, the LAPS analysis and the section on replacing RC4 with AES in Kerberos.
How much does PingCastle Enterprise cost?
PingCastle's purchase page lists Enterprise as "Starting at $30 / identity / year." Netwrix's own comparison page says "Request pricing," so treat $30 as a floor. PingCastle's services page also reserves the right to raise fees at each renewal.
Which free AD security tools can consultants use on client networks?
Read each license before you bill for it. PingCastle's free edition can't be used for paid client work. Outside Semperis's partner program, we couldn't find Purple Knight's terms for it. Locksmith and Locksmith 2 carry the Commons Clause, which limits paid services built on them. adPEAS v2 sells a commercial license for client work, from €350 a year. BloodHound CE is Apache-2.0 and Guerrilla, a newer open-source project, is CC BY 4.0. Both allow commercial use. Our Free plan isn't for paid client work either. That goes on our Auditor plan.
Why did my free copy of PingCastle stop running?
Each free build has a built-in end-of-support date. Netwrix's docs say "PingCastle only runs until the built-in license expiration date." Past that date the program exits with an "unsupported since" message. The 4.0 free builds run until January 31, 2028, per the README. Download a current build and it runs again.
Can I run PingCastle and Insight Recon on the same domain?
Yes. Both read AD without changing it and run as a regular domain user. Just know that the scores move in opposite directions. PingCastle's overall score is its worst category and a higher number means more risk. On our 0 to 100 Risk Posture Score, higher is better. Our PingCastle comparison goes through the differences one by one.
Sources. Editions, prices and licenses change. If something here is out of date, tell us and we'll fix it.