Air-gapped Active Directory Assessment | Insight Recon
Air-gapped installs
Air-gapped Active Directory assessment that stays inside your network
Insight Recon's air-gapped Active Directory assessment runs the whole web app and its database on a server inside your network. That server never connects back out and none of your scan data reaches us. Your team still gets every finding weighed for your domain, with the steps to fix it.
To judge the findings first, run the free scan on a connected lab domain. It's our cloud version, so keep it off the disconnected network.
The air-gapped install at a glance
Runs on
A server inside your network, with the whole web app and its database
Gets in
As a VM image, through your own transfer process
Traffic
Scanner to server on TCP 443. The server never connects back out.
Scan data
Never leaves your network
Updates
Signed offline files
Scan
Read-only, as a standard domain user. Nothing on your DCs.
Built by pentesters at Breach Point in Richmond, Virginia.
What runs where
There are two parts, your own Insight Recon server and a scanner in each domain. Both sit inside your network.
Your network, no internet
Each domain
Domain controllers
Plus certificate authorities and WSUS if you have them. Nothing gets installed.
Scanner reads themLDAP · SMB · RPC · DNS · HTTP · HTTPS
Each domain
Scanner
Runs as a standard domain user from a machine you pick
Sends resultsTCP 443, outbound
Your server
Insight Recon server
Your VM, running the whole web app and its database. Scans and reports stay here.
Never connects back out
Carried in by your peopleThrough your own transfer process
From us
The VM image, then signed update files
What you get
An air gap won't fix your AD
It keeps the internet out. It does nothing about a Kerberoastable service account, unconstrained delegation on an old app server, LDAP signing that isn't required or a krbtgt password nobody's reset since the domain was built. Anyone who's already inside goes after exactly those, same as we do on pentests.
Insight Recon checks for all of them, plus AD CS from ESC1 through ESC17, apart from ESC12. Your team gets the whole product on its own server, the same as our cloud version.
Severity based on your domain
The scanner reads your domain's settings before it flags or rates anything. A service account with no encryption types set only shows up when a DC would still hand it an RC4 ticket.
How to fix each finding
Every finding lists the accounts or objects it applies to and comes with Hacker Insight, our take on how we'd abuse it on a pentest. After that you get the fix as PowerShell or GUI steps, plus a way to check it worked.
A report your auditors can use
Each finding also tells you how to handle an exception and what evidence to keep. Findings map to DISA STIG and NIST SP 800-53 Rev 5 where they apply. The checks page lists each check's STIG IDs.
What's in your domain
It's all in the report, next to the findings:
- Each account's last logon and password age
- Computers and domain controllers
- Privileged groups and who's in them
- Group Policy, certificate authorities and templates
Before the paperwork
Judge the findings on a lab domain
Before anyone files a transfer request, run the free plan on a connected test or lab domain. It's our cloud version and sends AD metadata to our portal in Azure, so don't run it on the disconnected network.
Your scan data never leaves your network
Stays insideWhat the scanner reads
- Object attributes, like account flags, service principal names and when a password was last set
- Group memberships and who holds rights over sensitive objects
- Group Policy and certificate services configuration
- Trusts plus domain and forest settings
- Hardening settings from your domain controllers and AD servers
It all lands on your server, next to every scan and report.
Never sentWhat it doesn't send
- Passwords and password hashes
- Kerberos keys and tickets
- Your NTDS.dit database
- Anything in Entra ID. It doesn't scan a tenant.
If a check finds a password in an account description, the scanner masks it before upload.
None of this reaches us. The one number that does come out is your enabled account count, which your people send when your order form asks for it. The server itself never sends anything.
Ports and protocols
The connections the scanner makes
They all stay inside your network. Apart from signing in and sending results to your server, the scanner only reads.
Connection
Port
What it's for
LDAP and LDAPS
389, 636
Accounts, groups and permissions. Trusts, delegation and certificate templates.
Kerberos
88, TCP and UDP
Signing in to your domain controllers when your domain uses Kerberos
Global catalog
3268, 3269
Lookups across the domains in your forest
SMB
445
Group Policy files in SYSVOL and who can change them. It's also the backup route for Remote Registry.
Remote Registry
135 and dynamic RPC for WMI, or 445
Hardening settings on domain controllers, certificate authorities and WSUS servers. That covers SMB signing, PowerShell logging and hardened UNC paths.
DNS
53, UDP and TCP
Finding your domain controllers, plus zone transfer attempts to see whether anyone can pull your zones
HTTP and HTTPS
80, 443
Checking each certificate authority's /certsrv web enrollment page for NTLM relay. That's ESC8.
HTTPS checks
443, 8530, 8531
Whether management endpoints like WSUS use HTTPS and a valid certificate
To your server
443
Results go to your Insight Recon server, inside your network. The server never connects back out.
Those are the scanner's connections. A few checks, Net Session Enumeration Allowed among them, also read settings from member computers. The server's side comes up on the scoping call, starting with how your admins reach it.
Give your SOC a heads-up before the first scan
One check tries a DNS zone transfer to see whether anyone can pull your zones. Along with a burst of LDAP, SMB and Remote Registry reads, that looks like reconnaissance to some security tools. If you audit LDAP queries or remote registry access, the scan shows up under the account that ran it.
Getting it in
Who does what
Us
Ship the VM image
After we scope the deployment with you on a call, Insight Recon comes to you as a VM image.
You
Bring it in
Use your own transfer process. Once it's in, it never connects back out.
You
Scan each domain
Run the scanner as a standard domain user. It sends results to your server on outbound TCP 443.
Both
Keep it current
New checks and updates come from us as signed offline files. You bring them in the same way as the image.
For your security review
Your reviewers will want more than this page. Expect questions about the VM's operating system and sizing, how to verify signatures and how often updates ship. They'll want to know how licensing works offline. We go through all of it on the scoping call.
We're working on SOC 2 Type 2 and anyone can get our Type 1 report under NDA. Request a copy.
Limits
Things it won't do, on purpose
It's an assessment. It reads how Active Directory is set up and stops there.
- No attack detection. It doesn't monitor in real time or collect event logs, so keep your detection tools.
- No changes to AD. The scan only reads.
- No exploits or credential attacks. It doesn't try passwords or move laterally.
- No Domain Admin. A standard domain user is enough and we'd rather you didn't use Domain Admin for it.
- No Entra ID. It doesn't scan a tenant or connect to one.
Pricing
What an air-gapped install costs
It's Enterprise pricing, with a $15,000 minimum. Enterprise runs 20% over Standard, so it's $12 per enabled account a year on your first 1,000, $9.60 on the next 4,000 and $7.20 up to 25,000. A one-time deployment comes on top, quoted per project once we know your domains and how your network is split. We waive it on a 3-year agreement.
Consultants and MSSPs on our partner plans can add an air-gapped install as a quoted option.
Compare every planHow we price it
From $15,000 a year, plus your deployment
Subscription
From $12 down to $7.20 per enabled account a year
Minimum
$15,000 a year
One-time deployment
Quoted per project
On a 3-year agreement
Deployment waived
Other ways to assess an air-gapped domain
What each vendor's own docs say about disconnected networks, checked Oct 30, 2026.
-
PingCastle
Netwrix
The free edition runs from a zip with no install. Netwrix's 4.0 guide says "PingCastle only runs until the built-in license expiration date." The tool shows that date as End of Support. Past it you need to buy a license. PingCastle Enterprise runs on your own Windows Server, IIS and SQL Server. We couldn't find how its license behaves offline in Netwrix's license docs.
-
Purple Knight
Semperis
It's free, installed software that doesn't need admin rights. The Purple Knight FAQ says "Purple Knight has no phone-home capabilities" and describes it as a point-in-time view of AD and Entra ID risks.
-
Defender for Identity
Microsoft
Unlike Insight Recon, it watches for attacks as they happen. But it needs Microsoft's cloud. Microsoft's prerequisites say its sensors on your domain controllers "must be able to communicate with the Defender for Identity cloud service." The GCC High and DoD versions run in Azure Government. ATA, Microsoft's old on-prem product, left extended support in January 2026.
-
Tenable Identity Exposure
Tenable
It monitors AD continuously. Its on-prem edition runs on dedicated Windows servers you provide, with its data in SQL Server. For AD that has to sit in its own isolated zone, Tenable's design needs one inbound and one outbound network flow. Upgrades are installers you download from Tenable and run on each server. Its licensing page says "After your license expires, you can no longer sign in to the Tenable platform."
-
BloodHound Enterprise
SpecterOps
SpecterOps launched an on-prem edition in January 2026. Its announcement says it "functions fully without internet connectivity." The system requirements say air-gapped updates are a manual cycle where you download, transfer and apply them. It maps attack paths. That's a different job from a configuration assessment, so running both makes sense.
For a free, one-off check, PingCastle's free edition or Purple Knight will do the job. Check the End of Support date on a PingCastle build before you carry it in. Insight Recon fits when you want the whole app on a server you control, with findings rated for your domain and the fix for each one.
Whichever you pick, ask what the software does when its license runs out on a network that can't phone home. Ask us the same question.
What reviewers ask about air-gapped installs
Does the air-gapped install need internet access?
No. The whole web app and its database run on a server inside your network and that server never connects back out. Scanners reach it on TCP 443. Updates are signed offline files that come in through your own transfer process.
What gets installed on our domain controllers?
Nothing. The scanner runs from a machine you pick in each domain and reads your domain controllers over the network as a standard domain user. A few checks also read settings from member computers.
Can Breach Point see our scan results?
No. Breach Point builds Insight Recon but your results stay on your server, which never connects back out.
Will the scan set off our IDS?
It might, so warn your SOC first. A DNS zone transfer attempt and a burst of LDAP, SMB and Remote Registry reads look like reconnaissance to some tools.
Can one server cover several domains?
One server can take results from every domain whose scanner can reach it on TCP 443. If some of your networks can't reach each other, tell us how they're split on the scoping call. We build the deployment quote around that.
How much does an air-gapped install cost?
The air-gapped install uses Enterprise pricing, with a $15,000 minimum. The rate is $12 per enabled account a year and steps down to $9.60 past 1,000 accounts and $7.20 past 5,000. On top of that there's a quoted one-time deployment, which we waive on a 3-year agreement. Partner plans can add it as a quoted option. The pricing page has every plan.
How can we try it before we buy?
Run the free plan on a connected test or lab domain. It doesn't need a credit card and shows every finding except the hybrid identity checks, which need a paid plan. Since it's our cloud version, keep it off the disconnected network. The sample report shows a finished report without any scan at all.
Does it need Entra ID or Azure?
No. Insight Recon doesn't scan Entra ID or connect to a tenant. The air-gapped server never connects out to Azure or anywhere else.
Tell us how your network is split
Every air-gapped install starts with a call. We'll ask about your domains and how they connect, then quote the deployment.
Our security page covers how the cloud version handles data. Every plan is on the pricing page.