01
Insight Recon
by us, Breach Point
Our productFree plan
First because it's our page. Score it against the same list of wants as the other six.
Best for: Purple Knight users who want to know what to fix first, fix it and then prove it on the next scan.
- How it runs
- No install, standard domain user. A Windows agent runs scheduled scans on Standard and Enterprise.
- Checks
- 155+, chosen by pentesters. AD CS from ESC1 through ESC17, apart from ESC12.
- History
- New, modified or remediated status on every finding, scan to scan, on Standard and Enterprise
- Free plan
- One domain per company and every core AD finding. Paid client work needs a partner plan.
Insight Recon is built by pentesters. The AD tools we used on client work buried us in findings without saying where to start or helping much with the fix. We built this one to get all three right.
We picked every one of the 155+ checks on purpose, so you're not wading through noise. None of them are there to make the number bigger.
We weigh every finding against your environment. Take a service account with no encryption types set. It only shows up in your report when a DC would still hand it an RC4 ticket, which anyone in the domain can request and crack offline. Fully updated DCs treat it as AES-only, so there's nothing to report.
You won't have to guess where to start. Quick Wins collects the fixes with the biggest payoff for the least work. The Top 10 lists your riskiest findings. Paid plans add Account Risk Scores, which weigh the findings an account is tied to, how serious they are and its privilege chain. Open the account and you'll see how it gets into a group like Print Operators or Domain Admins. Sort by risk and you've got your lockdown list.
Some findings follow a whole path. One of our paid hybrid checks, Synchronization Principal Can Control Tier 0 Objects, traces chains like the one below. After you fix it, the next scan tells you whether the chain is broken.
- Sync account
- Nested group
- GPO
- Domain Controllers OU
Purple Knight's report includes remediation steps. Ours also have Hacker Insight, where we explain how we'd exploit each finding on a pentest. Every fix lists what to line up first, the PowerShell or GUI steps, how to prove it took and what evidence to keep. On Standard and Enterprise, rescans mark the finding remediated and the history shows whether it stays fixed.
The report also takes stock of the whole domain: every account's last logon and password age, privileged groups and their members, certificate templates and your Entra Connect setup.
We think the report is the best part. It's written so a manager can read the summary and stop, while the person doing the work gets the full fix under each finding. Our findings map to MITRE ATT&CK and ANSSI like Purple Knight's do, plus five more frameworks such as NIST CSF 2.0 and DISA STIG. Open the sample report and judge it yourself. It's a real scan of a test domain and it shows all 92 findings.
The free plan gives you one domain per company, along with every core AD finding, the Risk Posture Score and Quick Wins. History, scheduling, Account Risk Scores and the hybrid checks start at Standard. So do remediation tracking and new-finding alerts. On Standard, each of your first 1,000 accounts costs $10 a year, with a $3,000 minimum across every domain and forest you own. Consultants use the Auditor plan at $350 per client assessment. MSSPs who look after clients all year get partner rates on our MSSP plan.
Good at
- Scan history with new, modified or remediated status on every finding
- Every domain and forest you own on one Standard plan
- Published pricing for consultants, with rights for authorized client work
Watch for
- No Okta and no Entra ID tenant scan
- Mostly exposure, with a few compromise checks. No attack alerts or monitoring.
- SaaS by default. The air-gapped install is a quoted option on Enterprise and our partner plans.
Insight Recon vs Purple Knight · Pricing
02
PingCastle
by Netwrix
Free editionSource on GitHub
Best for: a second free AD health check now, with a published paid path to scheduling and client work later.
- How it runs
- Single-file Windows exe. Runs as a standard domain user in most cases.
- Free option
- Community edition, for internal use
- Public price
- Enterprise from $30 per identity a year. Client work from $1,000 per assessment.
- Covers
- AD, plus a basic legacy Entra ID scan for free. The 102-check Entra ID scanner needs Enterprise.
For a Purple Knight user, the interesting part of PingCastle is the paid path. Enterprise adds built-in scheduled scans, risk remediation tracking and multi-domain assessment. You can schedule the free build yourself with Windows Task Scheduler. Keeping track of what changed between reports is up to you. Client work has a written answer in the Service Providers license.
Good at
- A scoring model plenty of AD admins already know
- A published license for consultants
Watch for
- Free edition is internal use only. Netwrix's labels don't agree on the details.
- Free builds stop running after a built-in date
PingCastle alternatives, our other roundup · Insight Recon vs PingCastle
03
Semperis Lightning Intelligence
by Semperis
SaaSQuote only
Best for: teams that like Semperis's indicators and want them scheduled across forests and tenants, with trends.
- How it runs
- SaaS. A collector runs as a Windows service on one domain-joined machine per forest. It doesn't need to be a DC.
- Free option
- None found
- Public price
- Not published
- Covers
- Multi-forest AD and multi-tenant Entra ID
Semperis built this for Purple Knight users who asked for "easy deployment and automated scanning," according to iTWire's launch coverage. For always-on protection, Semperis sells Directory Services Protector. It tracks every AD change and can roll bad ones back. It's a much bigger install, with agents in each domain and its own SQL database.
Good at
- Same vendor and the same indicator approach
- Scheduled and on-demand scans with weekly trends
Watch for
- No public price or trial we could find
- A collector service to run in every forest
Semperis: Lightning Intelligence · Semperis: DSP
04
Netwrix 1Secure ITDR
by Netwrix
SaaSFree trial
Best for: smaller teams that want a hosted product with alerts and a price they can read before a sales call.
- How it runs
- Hosted SaaS that Netwrix runs in Azure
- Free option
- A free trial. No free edition.
- Public price
- Three editions, $17 to $34 a year per enabled AD user plus cloud-only Entra user
- Covers
- AD and Entra ID. The assessment runs on PingCastle's engine.
What Purple Knight users like here is that it keeps running after the first report. Netwrix's buy page lists activity monitoring and alerting next to the risk assessment, with a one-year minimum term. The prices are public and you can check out on your own up to 150 employees or 250 accounts.
Good at
- Alerts that keep running between assessments
- A free trial and list prices on the site
Watch for
- Self-serve plans come with community support only
- MSP pricing is on request
1Secure ITDR editions and prices · The MSP edition
05
Tenable Identity Exposure
by Tenable
Quote onlyAD and Entra ID
Best for: SOC teams that want Purple Knight-style checks running all the time, with alerts when an attack starts.
- How it runs
- Hosted, with a Secure Relay on a Windows server you run. An on-prem version runs on your own VMs.
- Free option
- No trial found. Demo on request.
- Public price
- Not published. Priced per enabled user across AD and Entra ID.
- Covers
- AD and Entra ID. 113 exposure and 17 attack indicators.
Purple Knight's indicators of compromise look for signs that something already happened. Tenable's indicators of attack watch for it while it's happening, from DCSync and DCShadow to Zerologon. If you picked Purple Knight for its GCC High support, note that Tenable says it doesn't support Entra ID in the US Government clouds. Plan for a relay server and a quote. Attack detection also needs a GPO-run listener on every DC.
Good at
- Attack detection on top of continuous exposure checks
- A running feed of AD changes to look back through
Watch for
- No list price and no trial we could find
- Sysmon on your DCs for some attack indicators
How we compare to Tenable Identity Exposure · Tenable's product page
06
Microsoft Defender for Identity
by Microsoft
In E5 and Defender Suite
Best for: E5 and Defender Suite shops that want always-on alerts across AD, Entra ID and Okta without buying another product.
- How it runs
- Sensors on your DCs and on AD CS, AD FS and Entra Connect servers
- Free option
- None. It needs an MDI license.
- Public price
- Defender Suite $12 per user a month, paid yearly, on top of Microsoft 365 E3. Business Premium add-on $10, up to 300 seats.
- Covers
- AD and hybrid posture, plus Okta posture once it's connected. Alerts span AD, Entra ID and Okta.
If Okta is part of why you run Purple Knight and you're licensed for E5, look here before you buy anything. Once Okta is connected, MDI's posture assessments include an Okta category with checks like MFA on privileged accounts and too many Super Admins. It's detection first, so posture lives in Secure Score as recommendations whose scores and statuses update every 24 hours.
Good at
- Often already licensed through E5
- Runs in GCC, GCC High and DoD
Watch for
- Sensors to deploy on every DC, plus AD CS and hybrid servers
- Sensors talk to Microsoft's cloud. We found no offline mode in the docs.
Insight Recon vs Defender for Identity · Microsoft Learn: MDI posture assessments
07
BloodHound CE and Enterprise
by SpecterOps
Free CEApache-2.0
Best for: mapping the attack paths to Tier Zero, which is a different job from an indicator scan.
- How it runs
- You host CE on PostgreSQL and Neo4j, fed by SharpHound and AzureHound. Enterprise is SaaS or on-prem.
- Free option
- CE, under Apache-2.0
- Public price
- $30.90 per employee a year for Enterprise on AWS Marketplace, with a $77,250 minimum
- Covers
- AD and Entra ID. Okta and GitHub through OpenGraph extensions you add to CE, pre-installed in Enterprise.
Semperis also has a free tool for this job. Forest Druid maps Tier 0 attack paths in AD and Entra ID. You get it the same way as Purple Knight, through a request form. BloodHound CE costs nothing and ships new releases constantly. You run it on your own box. Enterprise runs continuously and comes with the Okta and GitHub extensions pre-installed.
Good at
- Shows each step an attacker could take to Tier Zero
- Okta and GitHub attack paths in CE as well as Enterprise
Watch for
- Gives you paths to explore instead of a graded configuration report
- Enterprise has a $77,250 a year minimum at list
Our BloodHound comparison · The CE repo on GitHub