Insight Recon vs Purple Knight

Purple Knight Alternative · Identity Security

Looking for a Purple Knight alternative?

Purple Knight is one of the best-known free identity security assessment tools and covers Active Directory, Entra ID, and Okta with more than 218 indicators of exposure and compromise. Insight Recon is narrower in scope and more prescriptive after the scan. Here's where the two actually differ.

Updated August 2026 Technical comparison By the Insight Recon team

If you're searching for a Purple Knight alternative, the first thing to know is that Purple Knight is hard to beat on breadth for the price. It is free, covers three identity platforms, and includes both indicators of exposure and indicators of compromise. The reason to consider something else is usually not that Purple Knight fails to find anything. It is that your team wants a different workflow once the findings exist.

Insight Recon concentrates primarily on Active Directory and the on-premises hybrid identity components that connect AD to Entra ID. In exchange for that narrower scope, the product goes deeper on affected objects, attacker context, remediation paths, validation, account risk, and tracking findings from one scan to the next.

The bottom line

Purple Knight has the broader identity-security footprint. It assesses AD, Entra ID, and Okta, and Semperis currently advertises 218+ indicators of exposure and compromise. If you want broad identity coverage or specifically need Okta and IOC checks, Purple Knight has capabilities Insight Recon does not.

Insight Recon is more focused on turning AD findings into remediation work. Findings include the affected objects, attacker context, detailed remediation paths, validation guidance, and scan-to-scan status tracking. That makes it a better fit when the question is less “what exists?” and more “what do we fix next, and did we actually fix it?”

What Purple Knight does well

Purple Knight is a free identity security assessment tool from Semperis. It scans Active Directory, Entra ID, and Okta for indicators of exposure and indicators of compromise, then produces a security score and prioritized remediation guidance.

Semperis currently advertises more than 218 IOEs and IOCs across the product. Those indicators cover risky configurations, identity security weaknesses, known vulnerabilities, suspicious conditions, and signs that can indicate compromise rather than merely exposure.

That last part matters. Purple Knight is not only asking whether your identity configuration could be attacked. Some indicators are designed to look for evidence that something malicious may already have happened.

Purple Knight also has genuine multi-platform breadth. It assesses:

  • on-premises Active Directory;
  • Microsoft Entra ID;
  • Okta;
  • hybrid conditions that can expose more than one identity system.

The indicator library comes from Semperis's identity security research team and is mapped to frameworks including MITRE ATT&CK, MITRE D3FEND, and ANSSI. Semperis says Purple Knight has now been downloaded more than 75,000 times.

Purple Knight is not a stripped-down demo. The free product is useful on its own. Semperis's commercial Directory Services Protector platform is the step up when an organization needs continuous monitoring, alerting, change tracking, rollback, and automated response.

Why teams look for a Purple Knight alternative

The strongest reason to look beyond Purple Knight is not coverage. It already covers a lot.

The difference tends to appear when an engineer opens the report and starts turning findings into work.

During offensive security engagements, the questions we care about are usually more specific:

  • Which exact object gives the attacker the path?
  • How would we abuse this configuration?
  • Which findings deserve to go first?
  • What PowerShell, GPO, ADUC, or other change closes the issue?
  • What should be checked after the change?
  • What evidence should the team retain?
  • Did the finding actually disappear on the next scan?

Insight Recon was built around that workflow.

It currently runs 155+ checks across Active Directory and the on-premises hybrid identity footprint of Entra ID. The portable Windows scanner is available on every plan, the Windows agent for automated scheduled scans starts on Standard, and the portable Linux scanner is available on Auditor and Enterprise.

The Free plan includes the complete on-premises AD findings set for one domain. Standard adds Risk Posture Score, Quick Wins, Account Risk Scores, hybrid identity checks, scan history, trends, and scheduled scanning.

Purple Knight vs Insight Recon: feature comparison

Category Purple Knight Insight Recon
Primary use Broad identity security assessment across AD, Entra ID, and Okta AD security assessment, prioritization, remediation, and posture tracking
Active Directory Yes Yes
Entra ID Broad Entra ID assessment 24 checks focused on the on-premises hybrid identity footprint
Okta Yes No
Indicators / checks 218+ IOEs and IOCs 155+ checks
Indicators of compromise Yes No, exposure-focused assessment
Read-only assessment Yes Yes
Elevated AD privileges required No elevated/admin permissions required for AD assessment No elevated/admin permissions required
Windows portable scanner Windows application Every plan
Linux portable scanner Not the standard Purple Knight deployment model Auditor and Enterprise
Scheduled recurring scans Continuous workflow provided by Semperis DSP Windows agent on Standard and above
Attacker context Threat research, likelihood of compromise, framework context Dedicated Hacker Insight explaining the abuse case
Specific affected objects Indicator results expose relevant affected data Affected objects attached directly to findings
Remediation guidance Prioritized expert remediation guidance PowerShell, GPO, ADUC, or GUI paths where applicable
Validation guidance Remediation guidance varies by indicator Validation steps built into findings
Exceptions and evidence Not the primary report workflow Included where applicable
ADCS coverage ADCS-related security indicators included ESC1 through ESC16 family
Security score Overall and category-based percentage scoring 0–100 Risk Posture Score with letter grade on Standard+
Account risk scores Identity exposure represented across indicators Dedicated Account Risk Scores on Standard+
Built-in scan history Periodic rescanning; continuous monitoring is DSP Standard and above
New / modified / remediated status Continuous tracking available through DSP Automatic scan-to-scan status tracking
MITRE ATT&CK Yes Yes
MITRE D3FEND Yes Not currently a primary mapping
NIST / CIS / STIG Not emphasized as primary Purple Knight mappings Per finding, including Free
Cost to start Free Free for one domain with complete on-prem AD findings
Commercial multi-domain assessment workflow Semperis has commercial and partner offerings beyond Purple Knight Auditor: up to 50 domains, commercial rights, white-label reports, RBAC

Purple Knight capabilities are based on Semperis's current public product pages and documentation as of August 2026. Indicator libraries and product capabilities change regularly. Confirm current details with Semperis and review Insight Recon pricing for current Insight Recon plan entitlements.

Purple Knight has the broader platform coverage

There is no reason to dance around this part of the comparison.

Purple Knight covers Active Directory, Entra ID, and Okta. Insight Recon does not.

If Okta is an important part of your identity environment and you want one free assessment that looks across all three, Purple Knight has the stronger coverage story.

Purple Knight also includes indicators of compromise. Insight Recon does not try to be an IOC or threat-detection product. Its findings are focused on exposure and configuration that creates attacker opportunity.

Insight Recon's scope is more concentrated. The 155+ checks focus heavily on on-premises Active Directory, including areas such as:

  • dangerous ACLs and delegated permissions;
  • privileged groups and Tier 0 exposure;
  • Kerberos and service account weaknesses;
  • Group Policy and domain configuration;
  • ADCS, including the ESC1 through ESC16 family;
  • hybrid identity paths connecting on-prem AD to Entra ID.

On paid plans, 24 hybrid checks focus on the on-premises components that can bridge an AD compromise into Entra ID, including directory synchronization accounts, AZUREADSSOACC$, Cloud Kerberos Trust, AzureADKerberos, and related delegated permissions.

If breadth across identity platforms is the requirement, Purple Knight wins. Insight Recon is intentionally more concentrated around Active Directory and the hybrid trust paths attached to it.

The real distinction is how far the report carries the engineer

Purple Knight provides real remediation guidance. Semperis explicitly positions the product around prioritized guidance developed by its identity security experts, and the company's own customer research shows teams using that guidance to improve their scores.

The distinction is not “Purple Knight finds things, Insight Recon tells you how to fix them.” That would undersell Purple Knight.

The distinction is how much implementation detail is built into the finding workflow.

Purple Knight

Indicators include the security issue, severity or likelihood context, relevant threat-framework mappings, and expert remediation recommendations. This is strong guidance for identity and AD teams that know how to translate recommendations into their environment.

Insight Recon

Findings include the specific affected objects, Hacker Insight, remediation objective, PowerShell or GUI paths where applicable, validation steps, exceptions, evidence guidance, and a later scan that shows whether the finding closed.

For example, an Insight Recon finding for an account with PASSWD_NOTREQD does not stop at recommending that the flag be removed.

The report can identify the affected account, provide the PowerShell required to modify the UserAccountControl value, give the ADUC path, explain what to validate afterward, document exceptions and evidence, and then use the next scan to confirm that the issue is gone.

Harder findings use the same structure. ADCS template permissions, dangerous control over privileged objects, stale krbtgt passwords, synchronization principals, and AZUREADSSOACC$ all need more than a one-line recommendation if the goal is to move safely from detection to remediation.

Purple Knight is a snapshot. Semperis DSP is the continuous product.

Semperis is clear about this distinction.

Purple Knight provides a point-in-time assessment of AD and Entra ID risk. Organizations can run it periodically to see whether their environment improves or drifts.

Directory Services Protector is the Semperis product that adds continuous visibility: monitoring, change tracking, alerting, automated rollback, and response capabilities across AD and Entra ID.

That is a sensible product split, but it also creates an opening for teams that want something between an occasional free snapshot and a full identity threat detection and response platform.

Insight Recon Standard is $3,000 per year and retains every scan. The platform automatically identifies findings as new, modified, unchanged, or remediated and shows posture changes over time.

It is still an assessment product. It does not claim to replace DSP's real-time threat detection, tamperproof change tracking, automated rollback, or incident response capabilities.

Insight Recon sits in the middle: recurring assessment and remediation tracking without pretending to be a real-time ITDR platform.

The framework mappings are different too

Purple Knight has strong attacker-oriented framework alignment. Semperis maps its security indicators to MITRE ATT&CK, MITRE D3FEND, ANSSI, and other identity security guidance.

That's useful when the goal is understanding how an indicator connects to an adversary technique or defensive control.

Insight Recon also maps findings to MITRE ATT&CK and MITRE Mitigations, but adds mappings that are frequently useful for compliance and audit work:

  • NIST Cybersecurity Framework 2.0;
  • NIST SP 800-53 Rev. 5;
  • CIS Controls;
  • STIG;
  • ANSSI where applicable.

Those mappings are included with the findings on the Free plan as well.

If your main objective is threat modeling, Purple Knight's D3FEND and attacker-oriented framework support may be more relevant. If the report is also going into an audit package or risk register, Insight Recon's NIST, CIS, and STIG mappings may save work.

Which tool should you use?

We sell Insight Recon, so the useful version of this section is the one that tells you when we would choose Purple Knight too.

Purple Knight makes sense if...

  • You want broad coverage across AD, Entra ID, and Okta.
  • Okta is part of your identity stack.
  • You value indicators of compromise in addition to configuration exposure.
  • You want a free point-in-time assessment across a broad identity environment.
  • You value MITRE ATT&CK, MITRE D3FEND, and ANSSI alignment.
  • You are evaluating Semperis DSP for continuous identity threat detection and response.

Insight Recon makes sense if...

  • Your primary concern is Active Directory and its hybrid paths into Entra ID.
  • You want attacker context attached directly to each finding.
  • You want affected users, groups, computers, templates, or permissions surfaced with the issue.
  • Your engineers want detailed PowerShell, GPO, ADUC, or GUI remediation paths.
  • You want built-in validation, exception, and evidence guidance.
  • You want recurring scan history without buying a full ITDR platform.
  • You want dedicated Account Risk Scores on Standard and above.
  • You are a consultant or MSSP that wants flat multi-domain commercial licensing.

Three scenarios make the choice pretty easy

AD + ENTRA + OKTA

Start with Purple Knight

You get all three identity platforms in one free assessment, plus exposure and compromise indicators.

FIXING AD FINDINGS

Insight Recon is built for this

The report is structured around affected objects, attacker use, remediation, validation, and follow-up scans.

CONTINUOUS ITDR

Look at DSP, not Purple Knight

Real-time identity monitoring, rollback, and response is a different category from either point-in-time assessment tool.

You can also just run both

Purple Knight is free. Insight Recon's on-premises AD assessment is free for one domain.

That makes this one of the easier software comparisons to settle yourself.

Run both against the same environment. Look at what each one finds, then look at the actual finding details. Ask the engineer who would have to remediate the issues which report helps them more.

You may decide Purple Knight's broader identity coverage is more valuable. You may decide Insight Recon gives you a better remediation workflow. You may decide the reports answer different enough questions that you want both.

Purple Knight alternative FAQ

What is a good Purple Knight alternative?

Insight Recon is a Purple Knight alternative for teams that primarily care about Active Directory and want an assessment built around attacker context, specific affected objects, detailed remediation, validation, and scan-to-scan tracking. The complete on-premises Active Directory findings set is free for one domain.

Is Purple Knight really free?

Yes. Semperis offers Purple Knight as a free AD, Entra ID, and Okta security assessment tool. The company's commercial Directory Services Protector product adds continuous monitoring, alerting, change tracking, automated rollback, and other identity threat detection and response capabilities.

How many security indicators does Purple Knight have?

Semperis currently advertises more than 218 indicators of exposure and indicators of compromise across Purple Knight. The indicator library covers Active Directory, Entra ID, Okta, and hybrid identity risks and is regularly updated by Semperis's threat research team.

Can I use Insight Recon and Purple Knight together?

Yes. The tools have enough overlap to compare directly but also cover different ground. Purple Knight provides broader identity-platform coverage and includes compromise indicators. Insight Recon focuses more heavily on Active Directory, affected objects, attacker context, detailed remediation, and tracking findings between scans.

Does Purple Knight provide remediation guidance?

Yes. Purple Knight provides prioritized remediation guidance developed by Semperis identity security experts. Insight Recon takes a more prescriptive implementation approach by including specific affected objects, PowerShell, GPO, ADUC, or GUI paths where applicable, validation steps, exceptions, evidence guidance, and follow-up scan status.

Does Purple Knight track my score over time?

Purple Knight is positioned as a point-in-time assessment that can be run periodically. Semperis Directory Services Protector provides the continuous monitoring, alerting, change tracking, and response workflow. Insight Recon retains scan history and automatically tracks new, modified, unchanged, and remediated findings starting on the Standard plan.

How is Insight Recon's scoring different from Purple Knight's?

Both point in the same intuitive direction: higher scores indicate stronger posture. Purple Knight provides an overall security score and category scoring based on its security indicators. Insight Recon provides a 0-to-100 Risk Posture Score with a letter grade on Standard and above, plus dedicated Account Risk Scores for identifying particularly exposed identities.

Does Insight Recon cover Entra ID or Okta?

Insight Recon does not scan Okta and does not attempt to assess the full Entra ID tenant. Paid plans include 24 checks focused specifically on the on-premises hybrid identity components connecting Active Directory to Entra ID, including directory synchronization accounts, AZUREADSSOACC$, Cloud Kerberos Trust, AzureADKerberos, and related delegated permissions.

Can Insight Recon run on Linux?

Yes. The portable Linux scanner is available on Auditor and Enterprise. Portable Windows scanning is available on every plan, and Standard and above can use the Windows agent for automated scheduled scans.

Try the Purple Knight alternative against your own AD.

Run the complete on-premises Active Directory assessment for free. See every finding, the affected objects, attacker context, and remediation guidance before deciding whether you need the paid platform.

Run a Free Scan View Sample Report Compare Pricing
Read-only · no credit card · full AD findings

Purple Knight information in this comparison is based on publicly available Semperis product pages, security indicator documentation, and FAQs current as of August 2026. Semperis currently describes Purple Knight as a free AD, Entra ID, and Okta assessment with 218+ IOEs and IOCs and prioritized remediation guidance. Product capabilities change over time. If you spot something out of date, let us know and we'll correct it. See all Insight Recon comparisons.