PageSourceSearch

https://forestall.io/

html forestall.io collected 2026-10-08 07:23:39 UTC 113,760 bytes, 3 lines download raw bytes

1<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" as="image" fetchPriority="high" imageSrcSet="/images/homepage/hero/dashboard-v2-640.webp 640w, /images/homepage/hero/dashboard-v2-960.webp 960w, /images/homepage/hero/dashboard-v2-1280.webp 1280w, /images/homepage/hero/dashboard-v2-1600.webp 1600w" imageSizes="(max-width: 740px) 92vw, (max-width: 1080px) 680px, 600px"/><link rel="stylesheet" href="/_next/static/css/531451b1c9bd3be4.css" data-precedence="next"/><link rel="stylesheet" href="/_next/static/css/dd6b48e8ba8e96e8.css" data-precedence="next"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/webpack-64f73fd2d5bf7626.js"/>
1<script src="/_next/static/chunks/4bd1b696-f785427dddbba9fb.js" async=""></script>
1<script src="/_next/static/chunks/1255-a390e12b70b4a9fb.js" async=""></script>
1<script src="/_next/static/chunks/main-app-a3b835264aeada76.js" async=""></script>
1<script src="/_next/static/chunks/2619-3c9e02e22d10480a.js" async=""></script>
1<script src="/_next/static/chunks/1356-6b403f2800ac3ddf.js" async=""></script>
1<script src="/_next/static/chunks/app/page-dc38a96e83966032.js" async=""></script>
1<script src="/_next/static/chunks/app/global-error-380a09a8d1da3544.js" async=""></script>
1<script src="/_next/static/chunks/4675-ef764ba709c860e8.js" async=""></script>
1<script src="/_next/static/chunks/4115-35729b8a283b231c.js" async=""></script>
1<script src="/_next/static/chunks/app/layout-fb8e9302f8dfbbf6.js" async=""></script>
1<script src="/_next/static/chunks/app/error-3375bd2635d411f6.js" async=""></script>
1<script src="/_next/static/chunks/app/not-found-204f2e8031629712.js" async=""></script>
1<meta name="next-size-adjust" content=""/><meta property="og:site_name" content="Forestall"/><meta name="theme-color" content="#0b1620"/>
1<script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}window.gtag=window.gtag||gtag;gtag('consent','default',{ad_storage:'denied',ad_user_data:'denied',ad_personalization:'denied',analytics_storage:'denied',wait_for_update:500});gtag('set','url_passthrough',true);try{var fsm=document.cookie.match(/(?:^|; )fs_cookie_consent=([^;]*)/);if(fsm){var fsc=JSON.parse(decodeURIComponent(fsm[1]));if(fsc&&fsc.categories){gtag('consent','update',{analytics_storage:fsc.categories.analytics?'granted':'denied',ad_storage:fsc.categories.marketing?'granted':'denied',ad_user_data:fsc.categories.marketing?'granted':'denied',ad_personalization:fsc.categories.marketing?'granted':'denied'});}}}catch(e){}</script>
1<script type="application/ld+json">{"@context":"https://schema.org","@type":"Organization","@id":"https://forestall.io/#organization","name":"Forestall","url":"https://forestall.io","logo":"https://forestall.io/images/forestall_logo_black.svg","description":"Agentless Identity Security Posture Management (ISPM) and Identity Visibility & Intelligence Platform for Active Directory, Entra ID, Azure, Microsoft 365, AWS IAM, Google Cloud IAM, and Google Workspace.","foundingDate":"2020","sameAs":["https://www.linkedin.com/company/forestall-security","https://www.youtube.com/@forestallsecurity","https://x.com/forestallio","https://www.crunchbase.com/organization/forestall"],"contactPoint":{"@type":"ContactPoint","contactType":"sales","url":"https://forestall.io/company/contact-us"}}</script>
1<script type="application/ld+json">{"@context":"https://schema.org","@type":"WebSite","@id":"https://forestall.io/#website","name":"Forestall","url":"https://forestall.io","description":"Agentless Identity Security Posture Management across on-prem and cloud identity - Active Directory, Entra ID, Azure, Microsoft 365, AWS IAM, Google Cloud IAM, and Google Workspace.","publisher":{"@id":"https://forestall.io/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://forestall.io/resources/faqs?q={search_term_string}"},"query-input":"required name=search_term_string"}}</script>
1<script src="/_next/static/chunks/polyfills-42372ed130431b0a.js" noModule=""></script>
1</head><body class="__variable_f367f3 __variable_dd5b2f"><div hidden=""><!--$?--><template id="B:0"></template><!--/$--></div><div class="site-shell"><header class="site-header "><div class="container header-inner"><a class="brand" aria-label="Forestall home" href="/"><svg class="brand-logo" viewBox="0 0 4283 636" width="156" height="34" preserveAspectRatio="xMidYMid meet" role="img" aria-label="Forestall" xmlns="http://www.w3.org/2000/svg"><g fill="#232b2b"><path d="M1192 524 c-84.7 -6.2 -151.1 -62.4 -167.1 -141.6 -2.7 -13.8 -3.7 -43.7 -1.9 -58.2 8.2 -66 53.8 -120.5 118.6 -142.1 44.3 -14.8 95.6 -13.9 138.2 2.3 69.7 26.6 113.2 89.3 113.2 163.1 0 95.5 -72.3 169.7 -172.2 176.5 -7.8 0.5 -15.2 0.9 -16.3 0.8 -1.1 0 -6.7 -0.4 -12.5 -0.8z m37.5 -69.4 c53.3 -11.4 89.5 -62.4 83.7 -118.1 -5.5 -52 -42.5 -90.5 -93.2 -96.6 -30.9 -3.7 -64 7.7 -86.6 29.8 -52.7 51.5 -38.9 142.3 26.8 175.4 21.6 10.9 46.7 14.3 69.3 9.5z"></path><path d="M2540.9 522.9 c-44.8 -3 -92 -20.5 -127.6 -47.2 -4.6 -3.4 -8.3 -6.7 -8.3 -7.3 0 -0.6 6.8 -14.9 15 -31.8 14.1 -28.7 15.2 -30.7 16.9 -29.4 1 0.7 5.5 4.1 10 7.6 26.9 20.9 63.4 36.7 95 41.3 10.3 1.4 32.4 0.6 40 -1.5 19 -5.3 29.4 -17.9 27.7 -33.8 -0.8 -8.1 -3.9 -13.9 -10.6 -20.1 -9.9 -9.2 -22.6 -14.4 -65.7 -26.7 -35.9 -10.2 -52.6 -16.9 -69 -27.6 -27.3 -17.7 -40.8 -44.8 -38.9 -78.4 2.8 -51.7 40.8 -86.5 104.4 -95.6 14.3 -2.1 44 -2 59.7 0.1 20.3 2.7 36.9 6.7 56.5 13.6 10.1 3.6 37.3 16.9 41.2 20.1 l2.7 2.3 -14.4 31 c-8 17.1 -14.6 31.3 -14.7 31.8 -0.2 0.4 -6.1 -2.3 -13.2 -5.9 -16.7 -8.6 -27.3 -13.2 -42.2 -18.2 -34.3 -11.5 -63.9 -13.4 -81.1 -5.3 -10.2 4.9 -15.1 11.3 -16 21.1 -0.8 8.5 1.7 15.7 7.6 22.2 9.5 10.4 20.9 15.4 63.5 28.2 50.9 15.3 70.9 24.8 88.1 42.1 16.8 16.7 24.5 36.9 24.5 63.9 -0.1 41.2 -22.2 73.1 -63.1 90.8 -23.5 10.1 -56.6 14.9 -88 12.7z"></path><path d="M652 422.5 l0 -98.5 91.3 0 c50.3 0 102.9 0.3 117 0.7 l25.7 0.6 0 31.9 0 31.8 -78 0 -78 0 0 66 0 66 -39 0 -39 0 0 -98.5z"></path><path d="M1545 347.5 l0 -173.5 81.4 0 c48.1 0 85.6 0.4 91.7 1 58.8 5.8 97 31.8 111.9 76 8.9 26.3 8.6 63.1 -0.7 90.8 -8.9 26.7 -28.2 49.5 -52.1 61.6 -3 1.5 -5.2 3.2 -4.9 3.9 0.2 0.7 15.6 24.8 34.2 53.7 18.6 28.9 34.8 54.2 36.1 56.3 l2.4 3.7 -43.7 0 -43.8 0 -27.2 -49.3 -27.2 -49.2 -40.6 -0.3 -40.5 -0.2 0 49.5 0 49.5 -38.5 0 -38.5 0 0 -173.5z m173.5 7.2 c23.5 -5.6 38.5 -20.2 43.2 -42 1.8 -8.8 1.2 -28.7 -1.1 -36 -5.5 -17 -16.8 -28.2 -34.6 -34.1 -11.7 -3.8 -22.4 -4.6 -64.7 -4.6 l-39.3 0 0 59.6 0 59.5 44.8 -0.4 c37.1 -0.3 45.9 -0.7 51.7 -2z"></path><path d="M2002 418 l0 -103 132 0 132 0 0 32 0 32 -93 0 -93 0 0 39 0 39 95.5 0 95.5 0 0 32 0 32 -134.5 0 -134.5 0 0 -103z"></path><path d="M2919 380.5 l0 -140.5 -53 0 -53 0 0 -33 0 -33 144.5 0 144.5 0 0 33 0 33 -53 0 -53 0 0 140.5 0 140.5 -38.5 0 -38.5 0 0 -140.5z"></path><path d="M3169.4 519.3 c0.4 -1 34.1 -79.1 74.9 -173.5 l74.2 -171.7 40.1 
1-0.1 40.1 0 2.8 6.3 c10.5 24.2 144.5 339.5 144.5 340.1 0 0.3 -18.5 0.5 -41.2 0.4 l-41.1 -0.3 -22.9 -57 c-12.7 -31.3 -36.3 -90.1 -52.5 -130.5 -16.3 -40.4 -30.1 -74.6 -30.8 -75.8 -1.3 -2.6 -2.4 0.1 -95.9 230.8 l-13.2 32.5 -39.8 0.3 c-37.7 0.2 -39.8 0.1 -39.2 -1.5z"></path><path d="M3683 347.5 l0 -173.5 38.5 0 38.5 0 0 139.5 0 139.5 74.5 0 74.5 0 0 34 0 34 -113 0 -113 0 0 -173.5z"></path><path d="M4056 347.5 l0 -173.5 38.5 0 38.5 0 0 139.5 0 139.5 74.5 0 74.5 0 0 34 0 34 -113 0 -113 0 0 -173.5z"></path><path d="M2002 206.5 l0 -32.5 132 0 132 0 0 31.8 0 31.9 -64.7 0.6 c-35.5 0.4 -94.9 0.7 -132 0.7 l-67.3 0 0 -32.5z"></path><path d="M652 206 l0 -32 124.7 0 124.6 0 -0.6 24.2 c-0.4 13.3 -0.7 27.7 -0.7 32 l0 7.8 -124 0 -124 0 0 -32z"></path></g><g fill="#e1292d"><path d="M211.5 608 l-27 -27 27.3 -27.3 27.2 -27.2 27.2 27.2 27.3 27.3 -27 27 c-14.8 14.8 -27.2 27 -27.5 27 -0.3 0 -12.7 -12.2 -27.5 -27z"></path><path d="M77.9 474.3 c-27.8 -28 -52.1 -53 -54.1 -55.8 -6.4 -9.2 -10.7 -17.1 -14.7 -27.1 -14 -34.9 -10.4 -75.7 9.7 -108.5 6.4 -10.6 19.1 -23.6 188 -192.2 l87.9 -87.9 47.6 47.5 c42.4 42.4 54.3 54.9 58.4 61.3 0.7 1 2.3 3.5 3.6 5.4 3.2 5 8.3 16 11.3 24.4 8.9 25.4 8.1 57.7 -2.1 83.1 l-2.4 5.9 21.2 21.6 c17.4 17.7 22.2 23.2 26.9 30.9 26.9 43.9 23.5 100 -8.3 139.6 -2.6 3.3 -26.6 27.8 -53.3 54.5 l-48.6 48.5 -27.2 -27.2 -27.3 -27.3 50.1 -50.2 c58.4 -58.6 55.9 -55.4 55.9 -73.8 0 -9.8 -0.2 -11 -3.3 -17.5 -2.9 -6.2 -5.8 -9.5 -24.9 -28.7 l-21.6 -21.7 -61.9 61.2 c-34.1 33.7 -62.2 61.3 -62.6 61.5 -0.4 0.1 -12.9 -12 -27.7 -26.9 l-27 -27 87.2 -86.9 87.2 -86.8 -1.5 -5.4 c-3.3 -10.9 -5.2 -13.4 -27 -35.3 -11.8 -11.8 -21.7 -21.5 -22.2 -21.5 -0.4 0 -46.9 46.2 -103.3 102.7 -89.1 89.3 -102.9 103.5 -105.2 108.5 -7.4 15.7 -7.6 30.5 -0.5 46.2 3 6.7 5.5 9.5 50.2 54.4 l47.1 47.2 -27 27 c-14.8 14.9 -27.2 27 -27.5 27 -0.3 0 -23.3 -22.8 -51.1 -50.7z"></path></g></svg></a><nav class="main-nav" aria-label="Primary"><a href="/platform">Platform</a><div class="nav-dropdown-item"><button type="button" class="nav-trigger " aria-haspopup="true" aria-expanded="false">Solutions</button></div><div class="nav-dropdown-item"><button type="button" class="nav-trigger " aria-haspopup="true" aria-expanded="false">Use Cases</button></div><div class="nav-dropdown-item"><button type="button" class="nav-trigger " aria-haspopup="true" aria-expanded="false">Resources</button></div><div class="nav-dropdown-item"><button type="button" class="nav-trigger " aria-haspopup="true" aria-expanded="false">Company</button></div></nav><div class="header-actions"><a href="https://docs.forestall.io/fsprotect" target="_blank" rel="noreferrer" class="text-link">Documentation</a><a class="button button-primary" href="/company/contact-us?topic=demo#contact-form">Request a Demo</a></div><div class="mobile-header-actions"><a class="button button-primary" href="/company/contact-us?topic=demo#contact-form">Request a Demo</a><button type="button" class="menu-toggle" aria-expanded="false" aria-controls="mobile-drawer" aria-label="Toggle navigation menu"><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-menu" aria-hidden="true"><path d="M4 5h16"></path><path d="M4 12h16"></path><path d="M4 19h16"></path></svg></button></div></div><div id="mobile-drawer" class="mobile-drawer "><div class="container mobile-drawer-inner"><div class="mobile-drawer-actions"><a class="button button-primary mobile-drawer-cta" href="/company/contact-us?topic=demo#contact-form">Request a Demo</a></div><a href="/platform">Platform</a><section class="mobile-accordion-group"><button type="button" class="mobile-accordion-trigger " aria-expanded="false"><span>Solutions</span><span>+</span></button><div class="mobile-accordion-panel" hidden=""><div class="mobile-accordion-links"><ul><li><a href="/solutions/identity-attack-surface-management"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-radar" aria-hidden="true"><path d="M19.07 4.93A10 10 0 0 0 6.99 3.34"></path><path d="M4 6h.01"></path><path d="M2.29 9.62A10 10 0 1 0 21.31 8.35"></path><path d="M16.24 7.76A6 6 0 1 0 8.23 16.67"></path><path d="M12 18h.01"></path><path d="M17.99 11.66A6 6 0 0 1 15.77 16.67"></path><circle cx="12" cy="12" r="2"></circle><path d="m13.41 10.59 5.66-5.66"></path></svg><span>Identity Attack Surface Management</span></a></li><li><a href="/solutions/identity-risk-assessment"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewB
1ox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-shield-alert" aria-hidden="true"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z"></path><path d="M12 8v4"></path><path d="M12 16h.01"></path></svg><span>Identity Risk Assessment</span></a></li><li><a href="/solutions/attack-path-management"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-route" aria-hidden="true"><circle cx="6" cy="19" r="3"></circle><path d="M9 19h8.5a3.5 3.5 0 0 0 0-7h-11a3.5 3.5 0 0 1 0-7H15"></path><circle cx="18" cy="5" r="3"></circle></svg><span>Attack Path Management</span></a></li><li><a href="/solutions/compliance"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-badge-check" aria-hidden="true"><path d="M3.85 8.62a4 4 0 0 1 4.78-4.77 4 4 0 0 1 6.74 0 4 4 0 0 1 4.78 4.78 4 4 0 0 1 0 6.74 4 4 0 0 1-4.77 4.78 4 4 0 0 1-6.75 0 4 4 0 0 1-4.78-4.77 4 4 0 0 1 0-6.76Z"></path><path d="m9 12 2 2 4-4"></path></svg><span>Compliance</span></a></li><li><a href="/solutions/credential-discovery"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-key-round" aria-hidden="true"><path d="M2.586 17.414A2 2 0 0 0 2 18.828V21a1 1 0 0 0 1 1h3a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h1a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h.172a2 2 0 0 0 1.414-.586l.814-.814a6.5 6.5 0 1 0-4-4z"></path><circle cx="16.5" cy="7.5" r=".5" fill="currentColor"></circle></svg><span>Credential Discovery</span></a></li><li><a href="/solutions/reporting-automation"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-file-chart-column" aria-hidden="true"><path d="M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z"></path><path d="M14 2v5a1 1 0 0 0 1 1h5"></path><path d="M8 18v-1"></path><path d="M12 18v-6"></path><path d="M16 18v-3"></path></svg><span>Reporting Automation</span></a></li></ul></div></div></section><section class="mobile-accordion-group"><button type="button" class="mobile-accordion-trigger " aria-expanded="false"><span>Use Cases</span><span>+</span></button><div class="mobile-accordion-panel" hidden=""><div class="mobile-accordion-links"><p>By Role</p><ul><li><a href="/use-cases/by-role/red-team"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-crosshair" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><line x1="22" x2="18" y1="12" y2="12"></line><line x1="6" x2="2" y1="12" y2="12"></line><line x1="12" x2="12" y1="6" y2="2"></line><line x1="12" x2="12" y1="22" y2="18"></line></svg><span>Red Team</span></a></li><li><a href="/use-cases/by-role/identity-access-management"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-users" aria-hidden="true"><path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"></path><path d="M16 3.128a4 4 0 0 1 0 7.744"></path><path d="M22 21v-2a4 4 0 0 0-3-3.87"></path><circle cx="9" cy="7" r="4"></circle></svg><span>Identity Access Management</span></a></li><li><a href="/use-cases/by-role/system-administrator"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-wrench" aria-hidden="true"><path d="M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.106-3.105c.32-.322.863-.22.983.218a6 6 0 0 1-8.259 7.057l-7.91 7.91a1 1 0 0 1-2.999-3l7.91-7.91a6 6 0 0 1 7.057-8.259c.438.12.54.662.219.984z"></path></svg><span>System Administrator</span></a></li><li><a href="/use-cases/by-role/ciso"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewB
1ox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-briefcase" aria-hidden="true"><path d="M16 20V4a2 2 0 0 0-2-2h-4a2 2 0 0 0-2 2v16"></path><rect width="20" height="14" x="2" y="6" rx="2"></rect></svg><span>CISO</span></a></li></ul></div><div class="mobile-accordion-links"><p>By Threat</p><ul><li><a href="/use-cases/by-threat/ransomware"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-lock-keyhole" aria-hidden="true"><circle cx="12" cy="16" r="1"></circle><rect x="3" y="10" width="18" height="12" rx="2"></rect><path d="M7 10V7a5 5 0 0 1 10 0v3"></path></svg><span>Ransomware</span></a></li><li><a href="/use-cases/by-threat/apt-groups"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-ghost" aria-hidden="true"><path d="M9 10h.01"></path><path d="M15 10h.01"></path><path d="M12 2a8 8 0 0 0-8 8v12l3-3 2.5 2.5L12 19l2.5 2.5L17 19l3 3V10a8 8 0 0 0-8-8z"></path></svg><span>APT Groups</span></a></li><li><a href="/use-cases/by-threat/insider-threat"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-user-minus" aria-hidden="true"><path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"></path><circle cx="9" cy="7" r="4"></circle><line x1="22" x2="16" y1="11" y2="11"></line></svg><span>Insider Threat</span></a></li><li><a href="/use-cases/by-threat/nhi-agent-identity-compromise"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-shield-alert" aria-hidden="true"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z"></path><path d="M12 8v4"></path><path d="M12 16h.01"></path></svg><span>NHI &amp; Agent Identity Compromise</span></a></li></ul></div></div></section><section class="mobile-accordion-group"><button type="button" class="mobile-accordion-trigger " aria-expanded="false"><span>Resources</span><span>+</span></button><div class="mobile-accordion-panel" hidden=""><div class="mobile-accordion-links"><ul><li><a href="/resources/blog"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-newspaper" aria-hidden="true"><path d="M15 18h-5"></path><path d="M18 14h-8"></path><path d="M4 22h16a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2H8a2 2 0 0 0-2 2v16a2 2 0 0 1-4 0v-9a2 2 0 0 1 2-2h2"></path><rect width="8" height="4" x="10" y="6" rx="1"></rect></svg><span>Blog</span></a></li><li><a href="/identity-glossary"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-book-open" aria-hidden="true"><path d="M12 7v14"></path><path d="M3 18a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1h5a4 4 0 0 1 4 4 4 4 0 0 1 4-4h5a1 1 0 0 1 1 1v13a1 1 0 0 1-1 1h-6a3 3 0 0 0-3 3 3 3 0 0 0-3-3z"></path></svg><span>Identity Glossary</span></a></li><li><a href="/resources/white-papers"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-file-text" aria-hidden="true"><path d="M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z"></path><path d="M14 2v5a1 1 0 0 0 1 1h5"></path><path d="M10 9H8"></path><path d="M16 13H8"></path><path d="M16 17H8"></path></svg><span>White Papers</span></a></li><li><a href="/resources/faqs"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewB
1ox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-question-mark" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="M9.09 9a3 3 0 0 1 5.83 1c0 2-3 3-3 3"></path><path d="M12 17h.01"></path></svg><span>FAQs</span></a></li><li><a href="https://docs.forestall.io/fsprotect" target="_blank" rel="noreferrer"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-book-text" aria-hidden="true"><path d="M4 19.5v-15A2.5 2.5 0 0 1 6.5 2H19a1 1 0 0 1 1 1v18a1 1 0 0 1-1 1H6.5a1 1 0 0 1 0-5H20"></path><path d="M8 11h8"></path><path d="M8 7h6"></path></svg><span>Documentation</span></a></li></ul></div></div></section><section class="mobile-accordion-group"><button type="button" class="mobile-accordion-trigger " aria-expanded="false"><span>Company</span><span>+</span></button><div class="mobile-accordion-panel" hidden=""><div class="mobile-accordion-links"><ul><li><a href="/company/about"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-info" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="M12 16v-4"></path><path d="M12 8h.01"></path></svg><span>About</span></a></li><li><a href="/company/partnership"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-handshake" aria-hidden="true"><path d="m11 17 2 2a1 1 0 1 0 3-3"></path><path d="m14 14 2.5 2.5a1 1 0 1 0 3-3l-3.88-3.88a3 3 0 0 0-4.24 0l-.88.88a1 1 0 1 1-3-3l2.81-2.81a5.79 5.79 0 0 1 7.06-.87l.47.28a2 2 0 0 0 1.42.25L21 4"></path><path d="m21 3 1 11h-2"></path><path d="M3 3 2 14l6.5 6.5a1 1 0 1 0 3-3"></path><path d="M3 4h8"></path></svg><span>Partnership</span></a></li><li><a href="/company/security"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-shield-check" aria-hidden="true"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z"></path><path d="m9 12 2 2 4-4"></path></svg><span>Security</span></a></li><li><a href="/company/contact-us"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-mail" aria-hidden="true"><path d="m22 7-8.991 5.727a2 2 0 0 1-2.009 0L2 7"></path><rect x="2" y="4" width="20" height="16" rx="2"></rect></svg><span>Contact Us</span></a></li></ul></div><div class="mobile-accordion-links"><p>Legal</p><ul><li><a href="/privacy-policy"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-file-lock" aria-hidden="true"><path d="M4 9.8V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.706.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2h-3"></path><path d="M14 2v5a1 1 0 0 0 1 1h5"></path><path d="M9 17v-2a2 2 0 0 0-4 0v2"></path><rect width="8" height="5" x="3" y="17" rx="1"></rect></svg><span>Privacy Policy</span></a></li><li><a href="/terms-of-use"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-scroll-text" aria-hidden="true"><path d="M15 12h-5"></path><path d="M15 8h-5"></path><path d="M19 17V5a2 2 0 0 0-2-2H4"></path><path d="M8 21h12a2 2 0 0 0 2-2v-1a1 1 0 0 0-1-1H11a1 1 0 0 0-1 1v1a2 2 0 1 1-4 0V5a2 2 0 1 0-4 0v2a1 1 0 0 0 1 1h3"></path></svg><span>Terms of Use</span></a></li></ul></div></div></section><a href="https://docs.forestall.io/fsprotect" target="_blank" rel="noreferrer" class="mobile-docs-link">Documentation</a></div></div></header>
1<script type="application/ld+json">{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is Identity Security Posture Management (ISPM)?","acceptedAnswer":{"@type":"Answer","text":"ISPM (Identity Security Posture Management) is the practice of continuously discovering, assessing, and hardening identity infrastructure - finding misconfigurations, excessive privileges, and attack paths before attackers exploit them. Forestall also operates as an IVIP (Identity Visibility and Intelligence Platform), providing deeper intelligence across human and non-human identities."}},{"@type":"Question","name":"Does Forestall require agents?","acceptedAnswer":{"@type":"Answer","text":"Forestall uses connector-based, read-only collection for posture analysis and does not require endpoint agents to deliver core identity visibility."}},{"@type":"Question","name":"Does it require elevated privileges?","acceptedAnswer":{"@type":"Answer","text":"Forestall is designed for least-privilege access patterns and read-only integrations aligned to enterprise security requirements."}},{"@type":"Question","name":"What outputs do teams get?","acceptedA
1nswer":{"@type":"Answer","text":"Teams receive prioritized risk views, fix-first remediation guidance, reporting exports, and evidence artifacts for audit and governance workflows."}},{"@type":"Question","name":"How does attack path analysis help prioritize fixes?","acceptedAnswer":{"@type":"Answer","text":"Attack path analysis reveals which identities and relationships create the shortest path to impact, so teams can fix the highest-leverage issues first."}},{"@type":"Question","name":"Which identity environments are supported?","acceptedAnswer":{"@type":"Answer","text":"Forestall supports hybrid and multi-cloud identity environments: Active Directory, Entra ID, Azure, Microsoft 365 (Teams, SharePoint), AWS IAM, Google Cloud IAM, and Google Workspace - all in one agentless, read-only platform."}}]}</script>
1<script type="application/ld+json">{"@context":"https://schema.org","@type":"SoftwareApplication","name":"Forestall","applicationCategory":"SecurityApplication","operatingSystem":"Windows Server, Cloud","description":"Agentless ISPM and IVIP platform for discovering identity misconfigurations, mapping privilege escalation paths, detecting shadow admins, and generating compliance evidence across on-prem and cloud identity - Active Directory, Entra ID, Azure, Microsoft 365, AWS IAM, Google Cloud IAM, and Google Workspace. No Domain Admin required.","url":"https://forestall.io","featureList":["Identity Attack Surface Management","Identity Risk Assessment","Attack Path Management","Compliance Reporting (ISO 27001, NIST, PCI DSS, SAMA, NCA ECC, UAE IAR)","Credential Discovery","Non-Human Identity (NHI) Coverage","AI Agent Identity Coverage","Shadow Admin Detection","Tier-0 Asset Mapping","Multi-Cloud Identity Coverage (AWS IAM, Google Cloud IAM, Google Workspace)"],"offers":{"@type":"Offer","priceCurrency":"USD","availability":"https://schema.org/OnlineOnly","url":"https://forestall.io/company/contact-us"},"publisher":{"@id":"https://forestall.io/#organization"}}</script>
1<main class="home-main"><section class="home-hero"><div class="container home-hero-grid"><div class="reveal"><div class="hero-pill-row" aria-label="Hero badges"><span class="hero-pill">Identity Security Posture Management</span><span class="hero-pill">Identity Visibility &amp; Intelligence Platform (IVIP)</span></div><h1>Make identity risk visible across every identity - and actionable.</h1><p class="lead">Forestall is an agentless ISPM and IVIP platform. It helps security and IT teams discover identity exposures, map privilege escalation paths, and reduce risk across human identities, service accounts, and non-human identities - without Domain Admin privileges or endpoint agents.</p><div class="hero-cta-row"><a class="button button-primary" href="/company/contact-us?topic=demo#contact-form">Request a Demo</a><a class="button button-hero-outline" href="/platform">Platform</a></div></div><div class="hero-visual"><img src="/images/homepage/hero/dashboard-v2-1280.webp" srcSet="/images/homepage/hero/dashboard-v2-640.webp 640w, /images/homepage/hero/dashboard-v2-960.webp 960w, /images/homepage/hero/dashboard-v2-1280.webp 1280w, /images/homepage/hero/dashboard-v2-1600.webp 1600w" sizes="(max-width: 740px) 92vw, (max-width: 1080px) 680px, 600px" alt="Forestall Identity Risk Dashboard" width="1920" height="1468" fetchPriority="high" decoding="async" class="hero-dashboard-img"/></div></div></section><section class="stats-strip reveal" aria-labelledby="stats-strip-heading"><div class="container"><h2 id="stats-strip-heading" class="stats-strip-heading"><span>Identity is the #1 Attack Surface</span><span>Are you prepared?</span></h2><div class="stats-strip-grid"><article class="stats-card"><p class="stats-value">90<!-- -->%</p><p class="stats-label">of incidents involve the identity plane</p><div class="stats-source-logo-wrap"><a href="https://www.mandiant.com/m-trends" target="_blank" rel="noreferrer" aria-label="Source: Mandiant"><img alt="Mandiant logo" loading="lazy" width="140" height="34" decoding="async" data-nimg="1" class="stats-source-logo " style="color:transparent" srcSet="/_next/image?url=%2Fimages%2Fstats%2Fmandian.webp&amp;w=256&amp;q=75 1x, /_next/image?url=%2Fimages%2Fstats%2Fmandian.webp&amp;w=384&amp;q=75 2x" src="/_next/image?url=%2Fimages%2Fstats%2Fmandian.webp&amp;w=384&amp;q=75"/></a></div></article><article class="stats-card"><p class="stats-value">85<!-- -->%</p><p class="stats-label">of breach victims had insecure identity configurations</p><div class="stats-source-logo-wrap"><a href="https://www.gartner.com/en/documents/identity-security" target="_blank" rel="noreferrer" aria-label="Source: Gartner"><img alt="Gartner logo" loading="lazy" width="140" height="34" decoding="async" data-nimg="1" class="stats-source-logo " style="color:transparent" src="/images/stats/Gartner.svg"/></a></div></article><article class="stats-card"><p class="stats-value">70<!-- -->%</p><p class="stats-label">of organizations lack visibility into identity exposures</p><div class="stats-source-logo-wrap"><a href="https://www.microsoft.com/en-us/security/blog/microsoft-digital-defense-report/" target="_blank" rel="noreferrer" aria-label="Source: Microsoft"><img alt="Microsoft logo" loading="lazy" width="140" height="34" decoding="async" data-nimg="1" class="stats-source-logo " style="color:transparent" srcSet="/_next/image?url=%2Fimages%2Fstats%2Fmicrosoft.webp&amp;w=256&amp;q=75 1x, /_next/image?url=%2Fimages%2Fstats%2Fmicrosoft.webp&amp;w=384&amp;q=75 2x" src="/_next/image?url=%2Fimages%2Fstats%2Fmicrosoft.webp&amp;w=384&amp;q=75"/></a></div></article></div></div></section><section class="page-section reveal day-one-outcomes" aria-labelledby="day-one-outcomes-heading"><div class="container"><h2 id="day-one-outcomes-heading" class="day-one-outcomes-heading">What you will get from day one</h2><div class="day-one-outcomes-layout"><div class="day-one-accordion" role="list"><article class="day-one-item active" role="listitem"><button id="day-one-outcome-trigger-0" type="button" class="day-one-trigger" aria-expanded="true" aria-controls="day-one-outcome-panel-0"><span class="day-one-item-title">Full visibility across the enterprise identity plane</span><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down day-one-chevron" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button><div id="day-one-outcome-panel-0" class="day-one-panel" role="region" aria-labelledby="day-one-outcome-trigger-0" aria-hidden="false"><div class="day-one-panel-inner"><p>Build a unified view of identities, privileges, relationships, and configuration drift across on-premises and multi-cloud identity - AD, Entra ID, Azure, M365, AWS, GCP, and Google Worksp
1ace.</p></div></div></article><article class="day-one-item " role="listitem"><button id="day-one-outcome-trigger-1" type="button" class="day-one-trigger" aria-expanded="false" aria-controls="day-one-outcome-panel-1"><span class="day-one-item-title">Prioritized risks and misconfigurations</span><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down day-one-chevron" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button><div id="day-one-outcome-panel-1" class="day-one-panel" role="region" aria-labelledby="day-one-outcome-trigger-1" aria-hidden="true"><div class="day-one-panel-inner"><p>Stop chasing noise. Highlight the exposures most likely to be exploited and the changes that reduce risk fastest.</p></div></div></article><article class="day-one-item " role="listitem"><button id="day-one-outcome-trigger-2" type="button" class="day-one-trigger" aria-expanded="false" aria-controls="day-one-outcome-panel-2"><span class="day-one-item-title">Hidden attack paths and choke points</span><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down day-one-chevron" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button><div id="day-one-outcome-panel-2" class="day-one-panel" role="region" aria-labelledby="day-one-outcome-trigger-2" aria-hidden="true"><div class="day-one-panel-inner"><p>Understand how compromise could spread, where privileges escalate, and which controls break high-impact paths.</p></div></div></article><article class="day-one-item " role="listitem"><button id="day-one-outcome-trigger-3" type="button" class="day-one-trigger" aria-expanded="false" aria-controls="day-one-outcome-panel-3"><span class="day-one-item-title">Compliance scoring dashboards and guidance</span><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down day-one-chevron" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button><div id="day-one-outcome-panel-3" class="day-one-panel" role="region" aria-labelledby="day-one-outcome-trigger-3" aria-hidden="true"><div class="day-one-panel-inner"><p>Track posture against common requirements and generate audit-ready evidence with practical remediation guidance.</p></div></div></article><article class="day-one-item " role="listitem"><button id="day-one-outcome-trigger-4" type="button" class="day-one-trigger" aria-expanded="false" aria-controls="day-one-outcome-panel-4"><span class="day-one-item-title">Exposed credentials in shared files</span><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down day-one-chevron" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button><div id="day-one-outcome-panel-4" class="day-one-panel" role="region" aria-labelledby="day-one-outcome-trigger-4" aria-hidden="true"><div class="day-one-panel-inner"><p>Detect risky secrets and credentials that surface in shared storage and files, and reduce the blast radius with clear actions.</p></div></div></article><article class="day-one-item " role="listitem"><button id="day-one-outcome-trigger-5" type="button" class="day-one-trigger" aria-expanded="false" aria-controls="day-one-outcome-panel-5"><span class="day-one-item-title">Automated reports for security and hygiene</span><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down day-one-chevron" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button><div id="day-one-outcome-panel-5" class="day-one-panel" role="region" aria-labelledby="day-one-outcome-trigger-5" aria-hidden="true"><div class="day-one-panel-inner"><p>Export executive summaries and technical deep dives for continuous security improvement and operational hygiene.</p></div></div></article></div>
1<aside class="day-one-preview-card" aria-live="polite"><img alt="Identity Inventory and Relationships" loading="lazy" width="662" height="506" decoding="async" data-nimg="1" class="day-one-preview-img" style="color:transparent;cursor:zoom-in" sizes="(max-width: 1080px) 92vw, 580px" srcSet="/_next/image?url=%2Fimages%2Fhomepage%2F0x2%20-%20visibility.webp&amp;w=640&amp;q=80 640w, /_next/image?url=%2Fimages%2Fhomepage%2F0x2%20-%20visibility.webp&amp;w=750&amp;q=80 750w, /_next/image?url=%2Fimages%2Fhomepage%2F0x2%20-%20visibility.webp&amp;w=828&amp;q=80 828w, /_next/image?url=%2Fimages%2Fhomepage%2F0x2%20-%20visibility.webp&amp;w=1080&amp;q=80 1080w, /_next/image?url=%2Fimages%2Fhomepage%2F0x2%20-%20visibility.webp&amp;w=1200&amp;q=80 1200w, /_next/image?url=%2Fimages%2Fhomepage%2F0x2%20-%20visibility.webp&amp;w=1920&amp;q=80 1920w, /_next/image?url=%2Fimages%2Fhomepage%2F0x2%20-%20visibility.webp&amp;w=2048&amp;q=80 2048w, /_next/image?url=%2Fimages%2Fhomepage%2F0x2%20-%20visibility.webp&amp;w=3840&amp;q=80 3840w" src="/_next/image?url=%2Fimages%2Fhomepage%2F0x2%20-%20visibility.webp&amp;w=3840&amp;q=80"/></aside></div></div></section><section class="battle-tested-cta reveal" aria-label="Battle Tested Platform widget bar"><div class="container"><div class="battle-tested-bar"><div class="battle-tested-top"><div class="battle-tested-item battle-item-title"><p>Battle Tested Platform</p></div><div class="battle-tested-item battle-item-cta"><a class="button button-primary battle-cta-button" href="/company/contact-us?topic=demo#contact-form">Request a Demo</a></div></div><div class="battle-tested-stats"><div class="battle-tested-item battle-item-stat battle-item-stat-1"><p class="battle-stat-number">+<!-- -->10<!-- -->M</p><p class="battle-stat-label">Identities</p></div><div class="battle-tested-item battle-item-stat battle-item-stat-2"><p class="battle-stat-number">+<!-- -->500<!-- -->M</p><p class="battle-stat-label">Relations</p></div><div class="battle-tested-item battle-item-stat battle-item-stat-3"><p class="battle-stat-number">+<!-- -->200</p><p class="battle-stat-label">Enterprise IAM</p></div></div></div></div></section><section class="page-section reveal workflow-section"><div class="container"><h2>How Forestall works</h2><div class="workflow-grid"><article class="surface-card workflow-card"><div class="workflow-card-header"><span class="workflow-index">1</span><h3>Integrate</h3><span class="workflow-timeframe">1 Hour</span></div><p class="workflow-subtext">Connect to identity systems quickly with a read-only, low-friction setup.</p><ul class="workflow-pill-list" aria-label="Integrate capabilities"><li class="workflow-pill">Read-only</li><li class="workflow-pill">Without agents</li><li class="workflow-pill">Multi-cloud + on-prem</li></ul></article><article class="surface-card workflow-card"><div class="workflow-card-header"><span class="workflow-index">2</span><h3>Analyze</h3><span class="workflow-timeframe">1 Day</span></div><p class="workflow-subtext">Map identities and relationships to surface risk concentration and weak points.</p><ul class="workflow-pill-list" aria-label="Analyze capabilities"><li class="workflow-pill">Exposures</li><li class="workflow-pill">Choke Points</li><li class="workflow-pill">Exposed Credentials</li></ul></article><article class="surface-card workflow-card"><div class="workflow-card-header"><span class="workflow-index">3</span><h3>Act</h3><span class="workflow-timeframe">1 Week</span></div><p class="workflow-subtext">Turn prioritized findings into clear remediation tasks and audit-ready outputs.</p><ul class="workflow-pill-list" aria-label="Act capabilities"><li class="workflow-pill">Fix-first priorities</li><li class="workflow-pill">Remediation guidance</li><li class="workflow-pill">Evidence-ready reports</li></ul></article><article class="surface-card workflow-card"><div class="workflow-card-header"><span class="workflow-index">4</span><h3>Iterate</h3><span class="workflow-timeframe">1 Month</span></div><p class="workflow-subtext">Continuously measure posture change and keep teams aligned on progress.</p><ul class="workflow-pill-list" aria-label="Iterate capabilities"><li class="workflow-pill">Continuous posture tracking</li><li class="workflow-pill">Drift detection</li><li class="workflow-pill">Trend dashboards</li></ul></article></div><div class="workflow-actions"><a class="button button-secondary" href="/platform">Explore more</a></div></div></section><section class="page-section reveal compliance-coverage-section" aria-labelledby="compliance-coverage-heading"><div class="container"><div class="compliance-coverage-header"><h2 id="compliance-coverage-heading">Broad compliance support</h2><p>Built-in mappings and regulation-specific identity risk reports, ready to share with auditors and stakeholders.</p></div><div class="compliance-coverage-layout"><div class="compliance-coverage-copy"><p>Forestall helps teams measure identity posture, track gaps, and generate audit-ready outputs aligned to widely used standards and regional regulatory requirements. For each supported regulation, you get a tailored identity risk report that highlights relevant exposures, priorities, and remediation guidance.</p><ul class="compliance-coverage-bullets"><li>Regulation-specific identity risk reports (per framework)</li><li>Scoring dashboards mapped to control intent</li><li>Evidence-ready exports for audits and internal governance</li></ul></div><div class="compliance-grid-wrap"><div class="compliance-grid" aria-label="Supported regulations and mappings"><article class="compliance-tile"><div class="compliance-tile-logo-wrap"><img alt="ISO 27001 logo" loading="lazy" width="144" height="42" decoding="async" data-nimg="1" class="compliance-tile-logo " style="color:transparent" srcSet="/_next/image?url=%2Fimages%2Fframeworks%2Fiso27001.gif&amp;w=256&amp;q=75 1x, /_next/image?url=%2Fimages%2Fframeworks%2Fiso27001.gif&amp;w=384&amp;q=75 2x" src="/_next/image?url=%2Fimages%2Fframeworks%2Fiso27001.gif&amp;w=384&amp;q=75"/></div><h3>ISO27001</h3></article><article class="compliance-tile"><div class="compliance-tile-logo-wrap"><img alt="NIST logo" loading="lazy" width="144" height="42" decoding="async" data-nimg="1" class="compliance-tile-logo " style="color:transparent" src="/images/frameworks/nist.svg"/></div><h3>NIST</h3></article><article class="compliance-tile"><div class="compliance-tile-logo-wrap"><img alt="PCI DSS logo" loading="lazy" width="144" height="42" decoding="async" data-nimg="1" class="compliance-tile-logo " style="color:transparent" src="/images/frameworks/pci.svg"/></div><h3>PCI DSS</h3></article><article class="compliance-tile"><div class="compliance-tile-logo-wrap"><img alt="NCA ECC logo" loading="lazy" width="144" height="42" decoding="async" data-nimg="1" class="compliance-tile-logo compliance-tile-logo--ncaecc" style="color:transparent" srcSet="/_next/image?url=%2Fimages%2Fframeworks%2Fncaecc-20260215.webp&amp;w=256&amp;q=75 1x, /_next/image?url=%2Fimages%2Fframeworks%2Fncaecc-20260215.webp&amp;w=384&amp;q=75 2x" src="/_next/image?url=%2Fimages%2Fframeworks%2Fncaecc-20260215.webp&amp;w=384&amp;q=75"/></div><h3>NCA ECC</h3></article><article class="compliance-tile"><div class="compliance-tile-logo-wrap"><img alt="SAMA logo" loading="lazy" width="144" height="42" decoding="async" data-nimg="1" class="compliance-tile-logo " style="color:transparent" srcSet="/_next/image?url=%2Fimages%2Fframeworks%2Fsama.webp&amp;w=256&amp;q=75 1x, /_next/image?url=%2Fimages%2Fframeworks%2Fsama.webp&amp;w=384&amp;q=75 2x" src="/_next/image?url=%2Fimages%2Fframeworks%2Fsama.webp&amp;w=384&amp;q=75"/></div><h3>SAMA</h3></article><article class="compliance-tile"><div class="compliance-tile-logo-wrap"><img alt="UAE IAR logo" loading="lazy" width="144" height="42" decoding="async" data-nimg="1" class="compliance-tile-logo " style="color:transparent" srcSet="/_next/image?url=%2Fimages%2Fframeworks%2Ftdra.webp&amp;w=256&amp;q=75 1x, /_next/image?url=%2Fimages%2Fframeworks%2Ftdra.webp&amp;w=384&amp;q=75 2x" src="/_next/image?url=%2Fimages%2Fframeworks%2Ftdra.webp&amp;w=384&amp;q=75"/></div><h3>UAE IAR</h3></article><article class="compliance-tile"><div class="compliance-tile-logo-wrap"><img alt="CIS logo" loading="lazy" width="144" height="42" decoding="async" data-nimg="1" class="compliance-tile-logo " style="color:transparent" srcSet="/_next/image?url=%2Fimages%2Fframeworks%2Fcis.webp&amp;w=256&amp;q=75 1x, /_next/image?url=%2Fimages%2Fframeworks%2Fcis.webp&amp;w=384&amp;q=75 2x" src="/_next/image?url=%2Fimages%2Fframeworks%2Fcis.webp&amp;w=384&amp;q=75"/></div><h3>CIS</h3></article><article class="compliance-tile"><div class="compliance-tile-logo-wrap"><img alt="STIG logo" loading="lazy" width="144" height="42" decoding="async" data-nimg="1" class="compliance-tile-logo " style="color:transparent" srcSet="/_next/image?url=%2Fimages%2Fframeworks%2Fstig.webp&amp;w=256&amp;q=75 1x, /_next/image?url=%2Fimages%2Fframeworks%2Fstig.webp&amp;w=384&amp;q=75 2x" src="/_next/image?url=%2Fimages%2Fframeworks%2Fstig.webp&amp;w=384&amp;q=75"/></div><h3>STIG</h3></article><article class="compliance-tile"><div class="compliance-tile-logo-wrap"><img alt="Microsoft logo" loading="lazy" width="144" height="42" decoding="async" data-nimg="1" class="compliance-tile-logo " style="color:transparent" srcSet="/_next/image?url=%2Fimages%2Fframeworks%2Fmicrosoft.webp&amp;w=256&amp;q=75 1x, /_next/image?url=%2Fimages%2Fframeworks%2Fmicrosoft.webp&amp;w=384&amp;q=75 2x" src="/_next/image?url=%2Fimages%2Fframeworks%2Fmicrosoft.webp&amp;w=384&amp;q=75"/></div><h3>Microsoft</h3></article></div><div class="compliance-action-row"><a class="button compliance-button" href="/solutions/compliance">Explore more</a></div></div></div></div></section><section id="solutions" class="page-section reveal"><div class="container"><h2 class="solutions-section-heading">Explore our solutions</h2><div class="card-grid solution-grid"><a class="surface-card hoverable solution-card" href="/solutions/identity-attack-surface-management"><div class="trust-cert-badge-wrap"><span class="trust-cert-badge" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" width="26" height="26" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-radar" aria-hidden="true"><path d="M19.07 4.93A10 10 0 0 0 6.99 3.34"></path><path d="M4 6h.01"></path><path d="M2.29 9.62A10 10 0 1 0 21.31 8.35"></path><path d="M16.24 7.76A6 6 0 1 0 8.23 16.67"></path><path d="M12 18h.01"></path><path d="M17.99 11.66A6 6 0 0 1 15.77 16.67"></path><circle cx="12" cy="12" r="2"></circle><path d="m13.41 10.59 5.66-5.66"></path></svg></span><h3>Identity Attack Surface Management</h3></div><p>Continuously map identities, privileges, and trust relationships.</p><ul class="bullet-list"><li>Exposure inventory</li><li>Hotspot prioritization</li></ul></a><a class="surface-card hoverable solution-card" href="/solutions/identity-risk-assessment"><div class="trust-cert-badge-wrap"><span class="trust-cert-badge" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" width="26" height="26" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-shield-alert" aria-hidden="true"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z"></path><path d="M12 8v4"></path><path d="M12 16h.01"></path></svg></span><h3>Identity Risk Assessment</h3></div><p>Prioritize identity risk by likelihood, impact, and business context.</p><ul class="bullet-list"><li>Risk scoring</li><li>Ownership routing</li></ul></a><a class="surface-card hoverable solution-card" href="/solutions/attack-path-management"><div class="trust-cert-badge-wrap"><span class="trust-cert-badge" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" width="26" height="26" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-route" aria-hidden="true"><circle cx="6" cy="19" r="3"></circle><path d="M9 19h8.5a3.5 3.5 0 0 0 0-7h-11a3.5 3.5 0 0 1 0-7H15"></path><circle cx="18" cy="5" r="3"></circle></svg></span><h3>Attack Path Management</h3></div><p>Visualize and break high-impact attack paths across identity systems.</p><ul class="bullet-list"><li>Path analysis</li><li>Choke-point recommendations</li></ul></a><a class="surface-card hoverable solution-card" href="/solutions/compliance"><div class="trust-cert-badge-wrap"><span class="trust-cert-badge" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" width="26" height="26" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-badge-check" aria-hidden="true"><path d="M3.85 8.62a4 4 0 0 1 4.78-4.77 4 4 0 0 1 6.74 0 4 4 0 0 1 4.78 4.78 4 4 0 0 1 0 6.74 4 4 0 0 1-4.77 4.78 4 4 0 0 1-6.75 0 4 4 0 0 1-4.78-4.77 4 4 0 0 1 0-6.76Z"></path><path d="m9 12 2 2 4-4"></path></svg></span><h3>Compliance</h3></div><p>Translate posture findings into audit-ready evidence and workflows.</p><ul class="bullet-list"><li>Evidence packs</li><li>Control posture views</li></ul></a><a class="surface-card hoverable solution-card" href="/solutions/credential-discovery"><div class="trust-cert-badge-wrap"><span class="trust-cert-badge" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" width="26" height="26" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-key-round" aria-hidden="true"><path d="M2.586 17.414A2 2 0 0 0 2 18.828V21a1 1 0 0 0 1 1h3a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h1a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h.172a2 2 0 0 0 1.414-.586l.814-.814a6.5 6.5 0 1 0-4-4z"></path><circle cx="16.5" cy="7.5" r=".5" fill="currentColor"></circle></svg></span><h3>Credential Discovery</h3></div><p>Find credential exposures and reduce exploitation opportunities quickly.</p><ul class="bullet-list"><li>Exposure detection</li><li>Fix-first output lists</li></ul></a><a class="surface-card hoverable solution-card" href="/solutions/reporting-automation"><div class="trust-cert-badge-wrap"><span class="trust-cert-badge" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" width="26" height="26" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-file-chart-column" aria-hidden="true"><path d="M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z"></path><path d="M14 2v5a1 1 0 0 0 1 1h5"></path><path d="M8 18v-1"></path><path d="M12 18v-6"></path><path d="M16 18v-3"></path></svg></span><h3>Reporting Automation</h3></div><p>Automate recurring identity posture reports for technical and executive stakeholders.</p><ul class="bullet-list"><li>Scheduled report runs</li><li>Stakeholder-ready exports</li></ul></a></div></div></section><section id="use-cases" class="page-section section-muted reveal"><div class="container"><h2 class="use-cases-section-heading">Made for every team, threat and verticals</h2><div class="use-cases-split"><div class="use-cases-column"><h3 class="use-cases-sub-heading">By Role</h3><div class="card-grid tab-grid"><a class="surface-card hoverable tab-card" href="/use-cases/by-role/red-team"><div class="use-case-card-content"><img alt="Red Team" loading="lazy" width="160" height="160" decoding="async" data-nimg="1" class="use-case-card-img" style="color:transparent" sizes="80px" srcSet="/_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=16&amp;q=80 16w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=32&amp;q=80 32w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=48&amp;q=80 48w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=64&amp;q=80 64w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=96&amp;q=80 96w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=128&amp;q=80 128w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=256&amp;q=8
10 256w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=384&amp;q=80 384w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=640&amp;q=80 640w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=750&amp;q=80 750w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=828&amp;q=80 828w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=1080&amp;q=80 1080w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=1200&amp;q=80 1200w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=1920&amp;q=80 1920w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=2048&amp;q=80 2048w, /_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=3840&amp;q=80 3840w" src="/_next/image?url=%2Fimages%2Fhomepage%2F0x8%20-%20red%20team.webp&amp;w=3840&amp;q=80"/><div class="use-case-card-copy"><h3>Red Team</h3><p>Map real attack paths and exploitable privilege chains across on-premises and multi-cloud identity.</p></div></div></a><a class="surface-card hoverable tab-card" href="/use-cases/by-role/identity-access-management"><div class="use-case-card-content"><img alt="Identity Access Management" loading="lazy" width="160" height="160" decoding="async" data-nimg="1" class="use-case-card-img" style="color:transparent" sizes="80px" srcSet="/_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=16&amp;q=80 16w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=32&amp;q=80 32w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=48&amp;q=80 48w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=64&amp;q=80 64w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=96&amp;q=80 96w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=128&amp;q=80 128w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=256&amp;q=80 256w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=384&amp;q=80 384w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=640&amp;q=80 640w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=750&amp;q=80 750w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=828&amp;q=80 828w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=1080&amp;q=80 1080w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=1200&amp;q=80 1200w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=1920&amp;q=80 1920w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=2048&amp;q=80 2048w, /_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=3840&amp;q=80 3840w" src="/_next/image?url=%2Fimages%2Fhomepage%2F0x9%20-%20iam.webp&amp;w=3840&amp;q=80"/><div class="use-case-card-copy"><h3>Identity Access Management</h3><p>Continuously monitor excessive privileges, stale access, and misconfigured policies.</p></div></div></a><a class="surface-card hoverable tab-card" href="/use-cases/by-role/system-administrator"><div class="use-case-card-content"><img alt="System Administrator" loading="lazy" width="160" height="160" decoding="async" data-nimg="1" class="use-case-card-img" style="color:transparent" sizes="80px" srcSet="/_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=16&amp;q=80 16w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=32&amp;q=80 32w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=48&amp;q=80 48w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=64&amp;q=80 64w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=96&amp;q=80 96w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=128&amp;q=80 128w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=256&amp;q=80 256w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=384&amp;q=80 384w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=640&amp;q=80 640w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=750&amp;q=80 750w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=828&amp;q=80 828w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=1080&amp;q=80 1080w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=1200&amp;q=80 1200w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=1920&amp;q=80 1920w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=2048&amp;q=80 2048w, /_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=3840&amp;q=80 3840w" src="/_next/image?url=%2Fimages%2Fhomepage%2F0x10%20-%20sysadmin.webp&amp;w=3840&amp;q=80"/><div class="use-case-card-copy"><h3>System Administrator</h3><p>Detect misconfigurations and dormant accounts with clear remediation steps.</p></div></div></a><a class="surface-card hoverable tab-card" href="/use-cases/by-role/ciso"><div class="use-case-card-content"><img alt="CISO" loading="lazy" width="160" height="160" decoding="async" data-nimg="1" class="use-case-card-img" style="color:transparent" sizes="80px" srcSet="/_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=16&amp;q=80 16w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=32&amp;q=80 32w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=48&amp;q=80 48w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=64&amp;q=80 64w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=96&amp;q=80 96w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=128&amp;q=80 128w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=256&amp;q=80 256w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=384&amp;q=80 384w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=640&amp;q=80 640w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=750&amp;q=80 750w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=828&amp;q=80 828w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=1080&amp;q=80 1080w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=1200&amp;q=80 1200w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=1920&amp;q=80 1920w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=2048&amp;q=80 2048w, /_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=3840&amp;q=80 3840w" src="/_next/image?url=%2Fimages%2Fhomepage%2F0x11%20-%20ciso.webp&amp;w=3840&amp;q=80"/><div class="use-case-card-copy"><h3>CISO</h3><p>Track posture with executive dashboards, risk trends, and audit-ready evidence.</p></div></div></a></div></div><div class="use-cases-separator"></div><div class="use-cases-column"><h3 class="use-cases-sub-heading">By Threat</h3><div class="card-grid tab-grid"><a class="surface-card hoverable tab-card" href="/use-cases/by-threat/ransomware"><div class="use-case-card-content"><img alt="Ransomware" loading="lazy" width="160" height="160" decoding="async" data-nimg="1" class="use-case-card-img" style="color:transparent" sizes="80px" srcSet="/_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=16&amp;q=80 16w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=32&amp;q=80 32w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=48&amp;q=80 48w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=64&amp;q=80 64w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=96&amp;q=80 96w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=128&amp;q=80 128w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=256&amp;q=80 256w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=384&amp;q=80 384w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=640&amp;q=80 640w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=750&amp;q=80 750w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=828&amp;q=80 828w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=1080&amp;q=80 1080w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=1200&amp;q=80 1200w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=1920&amp;q=80 1920w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=2048&amp;q=80 2048w, /_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=3840&amp;q=80 3840w" src="/_next/image?url=%2Fimages%2Fhomepage%2F0x12%20-%20ransomware.webp&amp;w=3840&amp;q=80"/><div class="use-case-card-copy"><h3>Ransomware</h3><p>Uncover lateral movement paths and reduce blast radius before encryption begins.
1</p></div></div></a><a class="surface-card hoverable tab-card" href="/use-cases/by-threat/apt-groups"><div class="use-case-card-content"><img alt="APT Groups" loading="lazy" width="160" height="160" decoding="async" data-nimg="1" class="use-case-card-img" style="color:transparent" sizes="80px" srcSet="/_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=16&amp;q=80 16w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=32&amp;q=80 32w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=48&amp;q=80 48w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=64&amp;q=80 64w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=96&amp;q=80 96w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=128&amp;q=80 128w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=256&amp;q=80 256w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=384&amp;q=80 384w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=640&amp;q=80 640w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=750&amp;q=80 750w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=828&amp;q=80 828w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=1080&amp;q=80 1080w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=1200&amp;q=80 1200w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=1920&amp;q=80 1920w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=2048&amp;q=80 2048w, /_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=3840&amp;q=80 3840w" src="/_next/image?url=%2Fimages%2Fhomepage%2F0x13%20-%20apt.webp&amp;w=3840&amp;q=80"/><div class="use-case-card-copy"><h3>APT Groups</h3><p>Harden trust configurations and detect persistence mechanisms used by nation-state actors.</p></div></div></a><a class="surface-card hoverable tab-card" href="/use-cases/by-threat/insider-threat"><div class="use-case-card-content"><img alt="Insider Threat" loading="lazy" width="160" height="160" decoding="async" data-nimg="1" class="use-case-card-img" style="color:transparent" sizes="80px" srcSet="/_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=16&amp;q=80 16w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=32&amp;q=80 32w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=48&amp;q=80 48w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=64&amp;q=80 64w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=96&amp;q=80 96w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=128&amp;q=80 128w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=256&amp;q=80 256w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=384&amp;q=80 384w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=640&amp;q=80 640w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=750&amp;q=80 750w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=828&amp;q=80 828w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=1080&amp;q=80 1080w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=1200&amp;q=80 1200w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=1920&amp;q=80 1920w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=2048&amp;q=80 2048w, /_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=3840&amp;q=80 3840w" src="/_next/image?url=%2Fimages%2Fhomepage%2F0x14%20-%20insider%20threat.webp&amp;w=3840&amp;q=80"/><div class="use-case-card-copy"><h3>Insider Threat</h3><p>Expose hidden privilege accumulation and enforce separation of duties.</p></div></div></a><a class="surface-card hoverable tab-card" href="/use-cases/by-threat/nhi-agent-identity-compromise"><div class="use-case-card-content"><img alt="NHI &amp; Agent Identity Compromise" loading="lazy" width="160" height="160" decoding="async" data-nimg="1" class="use-case-card-img" style="color:transparent" sizes="80px" srcSet="/_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=16&amp;q=80 16w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=32&amp;q=80 32w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=48&amp;q=80 48w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=64&amp;q=80 64w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=96&amp;q=80 96w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=128&amp;q=80 128w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=256&amp;q=80 256w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=384&amp;q=80 384w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=640&amp;q=80 640w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=750&amp;q=80 750w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=828&amp;q=80 828w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=1080&amp;q=80 1080w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=1200&amp;q=80 1200w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=1920&amp;q=80 1920w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=2048&amp;q=80 2048w, /_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=3840&amp;q=80 3840w" src="/_next/image?url=%2Fimages%2Fhomepage%2F0x15%20-%20nhi.webp&amp;w=3840&amp;q=80"/><div class="use-case-card-copy"><h3>NHI &amp; Agent Identity Compromise</h3><p>Map non-human identities and service accounts to their privilege paths.</p></div></div></a></div></div></div></div></section><section class="page-section reveal resources-section" aria-labelledby="latest-resources-heading"><div class="container"><div class="resources-header"><div class="resources-heading-group"><h2 id="latest-resources-heading">Latest resources</h2><p>Practical guidance, product walkthroughs, and research on identity risk.</p></div></div><div class="blog-grid"><a class="blog-card surface-card hoverable" href="/resources/blog/sccm-cve-2026-47301"><div class="wp-card-image" aria-hidden="true"><img alt="" loading="lazy" decoding="async" data-nimg="fill" class="wp-card-hero-img" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent" sizes="(max-width: 768px) 100vw, 33vw" srcSet="/_next/image?url=%2Fimages%2Fblog%2Fsccm-cve-2026-47301%2Fhero.webp&amp;w=256&amp;q=75 256w, /_next/image?url=%2Fimages%2Fblog%2Fsccm-cve-2026-47301%2Fhero.webp&amp;w=384&amp;q=75 384w, /_next/image?url=%2Fimages%2Fblog%2Fsccm-cve-2026-47301%2Fhero.webp&amp;w=640&amp;q=75 640w, /_next/image?url=%2Fimages%2Fblog%2Fsccm-cve-2026-47301%2Fhero.webp&amp;w=750&amp;q=75 750w, /_next/image?url=%2Fimages%2Fblog%2Fsccm-cve-2026-47301%2Fhero.webp&amp;w=828&amp;q=75 828w, /_next/image?url=%2Fimages%2Fblog%2Fsccm-cve-2026-47301%2Fhero.webp&amp;w=1080&amp;q=75 1080w, /_next/image?url=%2Fimages%2Fblog%2Fsccm-cve-2026-47301%2Fhero.webp&amp;w=1200&amp;q=75 1200w, /_next/image?url=%2Fimages%2Fblog%2Fsccm-cve-2026-47301%2Fhero.webp&amp;w=1920&amp;q=75 1920w, /_next/image?url=%2Fimages%2Fblog%2Fsccm-cve-2026-47301%2Fhero.webp&amp;w=2048&amp;q=75 2048w, /_next/image?url=%2Fimages%2Fblog%2Fsccm-cve-2026-47301%2Fhero.webp&amp;w=3840&amp;q=75 3840w" src="/_next/image?url=%2Fimages%2Fblog%2Fsccm-cve-2026-47301%2Fhero.webp&amp;w=3840&amp;q=75"/></div><div class="wp-card-body"><div class="wp-card-top-row"><span class="wp-card-type-badge">Threat Analysis</span><span class="wp-card-date">Aug 13, 2026</span></div><h3 class="wp-card-title">SCCM Console Extension Chain (CVE-2026-47301): From Domain User to SYSTEM on the Site Server</h3><div class="wp-card-tags"><span class="wp-card-tag">Configuration Manager</span><span class="wp-card-tag">SCCM</span><span class="wp-card-tag">CVE-2026-47301</span></div><div class="wp-card-meta-row"><span class="wp-card-meta-item">15 min read</span></div></div></a><a class="blog-card surface-card hoverable" href="/resources/blog/kerberloss-cve-2026-25177"><div class="wp-card-image" aria-hidden="true"><img alt="" loading="lazy" decoding="async" data-nimg="fill" class="wp-card-hero-img" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent" sizes="(max-width: 768px) 100vw, 33vw" srcSet="/_next/image?url=%2Fimages%2Fblog%2Fkerberloss-cve-2026-25177%2Fhero.webp&amp;w=256&amp;q=75 256w, /_next/image?url=%2Fimages%2Fblog%2Fkerberloss-cve-2026-25177%2Fhero.webp&amp;w=384&amp;q=75 384w, /_next/image?url=%2Fimages%2Fblog%2Fkerberloss-cve-2026-25177%2Fhero.webp&amp;w=640&amp;q=75 640w, /_next/image?url=%2Fimages%2Fblog%2Fkerberloss-cve-2026-25177%2Fhero.webp&amp;w=750&amp;q=75 750w, /_next/image?url=%2Fimages%2Fblog%2Fkerberloss-cve-2026-25177%2Fhero.webp&amp;w=828&amp;q=75 828w, /_next/image?url=%2Fimages%2Fblog%2Fkerberloss-cve-2026-25177%2Fhero.webp&amp;w=1080&amp;q=75 1080w, /_next/image?url=%2Fimages%2Fblog%2Fkerberloss-cve-2026-25177%2Fhero.webp&amp;w=1200&amp;q=75 1200w, /_next/image?url=%2Fimages%2Fblog%2Fkerberloss-cve-2026-25177%2Fhero.webp&amp;w=1920&amp;q=75 1920w, /_next/image?url=%2Fimages%2Fblog%2Fkerberloss-cve-2026-25177%2Fhero.webp&amp;w=2048&amp;q=75 2048w, /_next/image?url=%2Fimages%2Fblog%2Fkerberloss-cve-2026-25177%2Fhero.webp&amp;w=3840&amp;q=75 3840w" src="/_next/image?url=%2Fimages%2Fblog%2Fkerberloss-cve-2026-25177%2Fhero.webp&amp;w=3840&amp;q=75"/></div><div class="wp-card-body"><div class="wp-card-top-row"><span class="wp-card-type-badge">Active Directory</span><span class="wp-card-date">Aug 7, 2026</span></div><h3 class="wp-card-title">KerberLoss (CVE-2026-25177): Invisible Unicode in Service Principal Names for DoS, Kerberos Downgrade, and SPN-Jacking</h3><div class="wp-card-tags"><span class="wp-card-tag">Active Directory</span><span class="wp-card-tag">Kerberos</span><span class="wp-card-tag">CVE-2026-25177</span></div><div class="wp-card-meta-row"><span class="wp-card-meta-item">11 min read</span></div></div></a><a class="blog-card surface-card hoverable" href="/resources/blog/resetnightmare-cve-2026-27912"><div class="wp-card-image" aria-hidden="true"><img alt="" loading="lazy" decoding="async" data-nimg="fill" class="wp-card-hero-img" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent" sizes="(max-width: 768px) 100vw, 33vw" srcSet="/_next/image?url=%2Fimages%2Fblog%2Fresetnightmare-cve-2026-27912%2Fhero.webp&amp;w=256&amp;q=75 256w, /_next/image?url=%2Fimages%2Fblog%2Fresetnightmare-cve-2026-27912%2Fhero.webp&amp;w=384&amp;q=75 384w, /_next/image?url=%2Fimages%2Fblog%2Fresetnightmare-cve-2026-27912%2Fhero.webp&amp;w=640&amp;q=75 640w, /_next/image?url=%2Fimages%2Fblog%2Fresetnightmare-cve-2026-27912%2Fhero.webp&amp;w=750&amp;q=75 750w, /_next/image?url=%2Fimages%2Fblog%2Fresetnightmare-cve-2026-27912%2Fhero.webp&amp;w=828&amp;q=75 828w, /_next/image?url=%2Fimages%2Fblog%2Fresetnightmare-cve-2026-27912%2Fhero.webp&amp;w=1080&amp;q=75 1080w, /_next/image?url=%2Fimages%2Fblog%2Fresetnightmare-cve-2026-27912%2Fhero.webp&amp;w=1200&amp;q=75 1200w, /_next/image?url=%2Fimages%2Fblog%2Fresetnightmare-cve-2026-27912%2Fhero.webp&amp;w=1920&amp;q=75 1920w, /_next/image?url=%2Fimages%2Fblog%2Fresetnightmare-cve-2026-27912%2Fhero.webp&amp;w=2048&amp;q=75 2048w, /_next/image?url=%2Fimages%2Fblog%2Fresetnightmare-cve-2026-27912%2Fhero.webp&amp;w=3840&amp;q=75 3840w" src="/_next/image?url=%2Fimages%2Fblog%2Fresetnightmare-cve-2026-27912%2Fhero.webp&amp;w=3840&amp;q=75"/></div><div class="wp-card-body"><div class="wp-card-top-row"><span class="wp-card-type-badge">Active Directory</span><span class="wp-card-date">Aug 7, 2026</span></div><h3 class="wp-card-title">ResetNightmare (CVE-2026-27912): Full Domain Takeover Through the Kerberos Change Password Protocol</h3><div class="wp-card-tags"><span class="wp-card-tag">Active Directory</span><span class="wp-card-tag">Kerberos</span><span class="wp-card-tag">CVE-2026-27912</span></div><div class="wp-card-meta-row"><span class="wp-card-meta-item">12 min read</span></div></div></a></div><div class="resources-footer-cta"><a class="button resources-view-all-button" href="/resources">View all resources</a></div></div></section><section class="page-section section-muted reveal"><div class="container faq-wrap"><h2 class="faq-heading">Frequently asked questions</h2><div class="faq-list"><article class="faq-item active"><button type="button" class="faq-question" aria-expanded="true"><span>What is Identity Security Posture Management (ISPM)?</span><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down faq-chevron" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button><div class="faq-answer" aria-hidden="false"><div class="faq-answer-inner"><p>ISPM (Identity Security Posture Management) is the practice of continuously discovering, assessing, and hardening identity infrastru
1cture - finding misconfigurations, excessive privileges, and attack paths before attackers exploit them. Forestall also operates as an IVIP (Identity Visibility and Intelligence Platform), providing deeper intelligence across human and non-human identities.</p></div></div></article><article class="faq-item"><button type="button" class="faq-question" aria-expanded="false"><span>Does Forestall require agents?</span><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down faq-chevron" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button><div class="faq-answer" aria-hidden="true"><div class="faq-answer-inner"><p>Forestall uses connector-based, read-only collection for posture analysis and does not require endpoint agents to deliver core identity visibility.</p></div></div></article><article class="faq-item"><button type="button" class="faq-question" aria-expanded="false"><span>Does it require elevated privileges?</span><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down faq-chevron" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button><div class="faq-answer" aria-hidden="true"><div class="faq-answer-inner"><p>Forestall is designed for least-privilege access patterns and read-only integrations aligned to enterprise security requirements.</p></div></div></article><article class="faq-item"><button type="button" class="faq-question" aria-expanded="false"><span>What outputs do teams get?</span><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down faq-chevron" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button><div class="faq-answer" aria-hidden="true"><div class="faq-answer-inner"><p>Teams receive prioritized risk views, fix-first remediation guidance, reporting exports, and evidence artifacts for audit and governance workflows.</p></div></div></article><article class="faq-item"><button type="button" class="faq-question" aria-expanded="false"><span>How does attack path analysis help prioritize fixes?</span><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down faq-chevron" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button><div class="faq-answer" aria-hidden="true"><div class="faq-answer-inner"><p>Attack path analysis reveals which identities and relationships create the shortest path to impact, so teams can fix the highest-leverage issues first.</p></div></div></article><article class="faq-item"><button type="button" class="faq-question" aria-expanded="false"><span>Which identity environments are supported?</span><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down faq-chevron" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button><div class="faq-answer" aria-hidden="true"><div class="faq-answer-inner"><p>Forestall supports hybrid and multi-cloud identity environments: Active Directory, Entra ID, Azure, Microsoft 365 (Teams, SharePoint), AWS IAM, Google Cloud IAM, and Google Workspace - all in one agentless, read-only platform.</p></div></div></article></div></div></section><section class="cta-band reveal"><div class="container cta-band-inner"><h2>See your full identity attack surface <span class="cta-keep-together">- clearly.</span></h2><p>Request a demo to explore your environment&#x27;s highest-impact risks and fix-first priorities.</p><div class="hero-cta-row cta-band-actions"><a class="button button-primary" href="/company/contact-us?topic=demo#contact-form">Request a Demo</a></div></div></section></main><!--$?--><template id="B:1"></template><!--/$--><footer class="site-footer"><div class="site-footer-surface"><div class="container site-footer-main"><div class="footer-brand-column"><section class="footer-brand-block" aria-label="Forestall footer branding"><a class="footer-logo-link" aria-label="Forestall home" href="/"><img alt="Forestall" loading="lazy" width="260" height="39" decoding="async" data-nimg="1" class="footer-logo" style="color:transparent" src="/images/forestall_logo_white.svg"/></a><p>Identity Security Posture Management and Identity Visibility &amp; Intelligence Platform.</p></section><section class="footer-newsletter"><h3>Subscribe to our newsletter</h3><form class="footer-newsletter-form" noValidate=""><label for="footer-newsletter-email" class="sr-only">Email address</label><input id="footer-newsletter-email" type="email" autoComplete="email" placeholder="Work email" value=""/><button type="submit">Subscribe</button></form>
1<div class="footer-newsletter-status" aria-live="polite"></div></section></div><div class="footer-sitemap-grid"><section class="footer-group footer-group-stacked"><div class="footer-subgroup"><h3><a href="/platform">Platform</a></h3></div><div class="footer-subgroup"><h4 class="footer-major-subheading"><a href="/solutions">Solutions</a></h4><ul><li><a href="/solutions/identity-attack-surface-management">Identity Attack Surface Management</a></li><li><a href="/solutions/identity-risk-assessment">Identity Risk Assessment</a></li><li><a href="/solutions/attack-path-management">Attack Path Management</a></li><li><a href="/solutions/compliance">Compliance</a></li><li><a href="/solutions/credential-discovery">Credential Discovery</a></li><li><a href="/solutions/reporting-automation">Reporting Automation</a></li></ul></div></section><section class="footer-group footer-group-use-cases"><h3><a href="/use-cases">Use Cases</a></h3><div class="footer-use-cases-grid"><div class="footer-use-cases-left"><div class="footer-subgroup"><h4>By Role</h4><ul><li><a href="/use-cases/by-role/red-team">Red Team</a></li><li><a href="/use-cases/by-role/identity-access-management">Identity Access Management</a></li><li><a href="/use-cases/by-role/system-administrator">System Administrator</a></li><li><a href="/use-cases/by-role/ciso">CISO</a></li></ul></div><div class="footer-subgroup"><h4>By Threat</h4><ul><li><a href="/use-cases/by-threat/ransomware">Ransomware</a></li><li><a href="/use-cases/by-threat/apt-groups">APT Groups</a></li><li><a href="/use-cases/by-threat/insider-threat">Insider Threat</a></li><li><a href="/use-cases/by-threat/nhi-agent-identity-compromise">NHI &amp; Agent Identity Compromise</a></li></ul></div></div></div></section><section class="footer-group"><div class="footer-subgroup"><h3><a href="/resources">Resources</a></h3><ul><li><a href="/resources/blog">Blog</a></li><li><a href="/identity-glossary">Identity Glossary</a></li><li><a href="/resources/faqs">FAQs</a></li><li><a href="https://docs.forestall.io/fsprotect" target="_blank" rel="noreferrer">Documentation</a></li></ul></div></section><section class="footer-group footer-group-company"><h3><a href="/company/about">Company</a></h3><ul><li><a href="/company/about">About</a></li><li><a href="/company/partnership">Partnership</a></li><li><a href="/company/security">Security</a></li><li><a href="/company/contact-us">Contact Us</a></li></ul></section></div></div><div class="container footer-bottom-bar"><div class="footer-bottom-meta"><p>© <!-- -->2026<!-- --> Forestall. All rights reserved.</p><div class="footer-bottom-links"><a href="/privacy-policy">Privacy Policy</a><a href="/terms-of-use">Terms of Use</a><a href="/cookie-policy">Cookie Policy</a><button type="button" class="fs-footer-cookie-btn">Cookie Preferences</button></div></div><div class="footer-bottom-social" aria-label="Follow Forestall"><a href="https://www.linkedin.com/company/forestall-security" target="_blank" rel="noreferrer" aria-label="Forestall on LinkedIn" class="footer-social-link"><svg xmlns="http://www.w3.org/2000/svg" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-linkedin" aria-hidden="true"><path d="M16 8a6 6 0 0 1 6 6v7h-4v-7a2 2 0 0 0-2-2 2 2 0 0 0-2 2v7h-4v-7a6 6 0 0 1 6-6z"></path><rect width="4" height="12" x="2" y="9"></rect><circle cx="4" cy="4" r="2"></circle></svg><span>LinkedIn</span></a><a href="https://www.youtube.com/@forestallsecurity" target="_blank" rel="noreferrer" aria-label="Forestall on YouTube" class="footer-social-link"><svg xmlns="http://www.w3.org/2000/svg" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-youtube" aria-hidden="true"><path d="M2.5 17a24.12 24.12 0 0 1 0-10 2 2 0 0 1 1.4-1.4 49.56 49.56 0 0 1 16.2 0A2 2 0 0 1 21.5 7a24.12 24.12 0 0 1 0 10 2 2 0 0 1-1.4 1.4 49.55 49.55 0 0 1-16.2 0A2 2 0 0 1 2.5 17"></path><path d="m10 15 5-3-5-3z"></path></svg><span>YouTube</span></a></div></div></div></footer></div><div class="fs-banner" role="region" aria-label="Cookie consent"><div class="fs-banner-inner container"><div class="fs-banner-copy"><h2 class="fs-banner-title">We respect your privacy</h2><p class="fs-banner-body">We use cookies to keep this site secure and working properly. With your permission, we also use optional cookies to understand usage and improve the experience.<!-- --> <a class="fs-banner-link" href="/cookie-policy">Cookie Policy</a></p><p class="fs-banner-note">You can change your choice at any time.</p></div><div class="fs-banner-actions"><button type="button" class="button button-primary">Accept all</button><button type="button" class="button button-secondary">
1Reject non-essential</button><button type="button" class="fs-banner-manage">Manage preferences</button></div></div></div>
1<script>requestAnimationFrame(function(){$RT=performance.now()});</script>
1<script src="/_next/static/chunks/webpack-64f73fd2d5bf7626.js" id="_R_" async=""></script>
1<div hidden id="S:1"></div>
1<script>$RB=[];$RV=function(a){$RT=performance.now();for(var b=0;b<a.length;b+=2){var c=a[b],e=a[b+1];null!==e.parentNode&&e.parentNode.removeChild(e);var f=c.parentNode;if(f){var g=c.previousSibling,h=0;do{if(c&&8===c.nodeType){var d=c.data;if("/$"===d||"/&"===d)if(0===h)break;else h--;else"$"!==d&&"$?"!==d&&"$~"!==d&&"$!"!==d&&"&"!==d||h++}d=c.nextSibling;f.removeChild(c);c=d}while(c);for(;e.firstChild;)f.insertBefore(e.firstChild,c);g.data="$";g._reactRetry&&requestAnimationFrame(g._reactRetry)}}a.length=0};
2$RC=function(a,b){if(b=document.getElementById(b))(a=document.getElementById(a))?(a.previousSibling.data="$~",$RB.push(a,b),2===$RB.length&&("number"!==typeof $RT?requestAnimationFrame($RV.bind(null,$RB)):(a=performance.now(),setTimeout($RV.bind(null,$RB),2300>a&&2E3<a?2300-a:$RT+300-a)))):b.parentNode.removeChild(b)};$RC("B:1","S:1")</script>
2<title>Forestall | Identity Security Posture Management</title><meta name="description" content="Discover identity exposures, prioritize risk, and reduce attack paths with Forestall - a safe, actionable approach to identity security posture management."/><link rel="manifest" href="/manifest.webmanifest"/><meta name="robots" content="index, follow"/><link rel="canonical" href="https://forestall.io"/><meta property="og:title" content="Forestall | Identity Security Posture Management"/><meta property="og:description" content="Discover identity exposures, prioritize risk, and reduce attack paths with Forestall - a safe, actionable approach to identity security posture management."/><meta property="og:url" content="https://forestall.io"/><meta property="og:image" content="https://forestall.io/images/platform-og.svg"/><meta property="og:image:alt" content="Forestall ISPM Platform"/><meta property="og:type" content="website"/><meta name="twitter:card" content="summary_large_image"/><meta name="twitter:title" content="Forestall | ISPM and Identity Visibility &amp; Intelligence Platform"/><meta name="twitter:description" content="Forestall is an agentless ISPM and Identity Visibility &amp; Intelligence platform. Discover identity exposures, map privilege escalation paths, and reduce risk across on-premises and multi-cloud identity - no Domain Admin required."/><meta name="twitter:image" content="https://forestall.io/images/platform-og.svg"/><meta name="twitter:image:alt" content="Forestall identity security posture management platform overview"/><link rel="icon" href="/favicon.ico" type="image/x-icon" sizes="16x16"/><link rel="icon" href="/icon.png?0f0428ed34f6e98e" type="image/png" sizes="32x32"/><link rel="apple-touch-icon" href="/apple-icon.png?b67d017ec32b9ef1" type="image/png" sizes="180x180"/>
2<script >document.querySelectorAll('body link[rel="icon"], body link[rel="apple-touch-icon"]').forEach(el => document.head.appendChild(el))</script>
2<div hidden id="S:0"></div>
2<script>$RC("B:0","S:0")</script>
2<script>(self.__next_f=self.__next_f||[]).push([0])</script>
2<script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n4:I[9564,[\"2619\",\"static/chunks/2619-3c9e02e22d10480a.js\",\"1356\",\"static/chunks/1356-6b403f2800ac3ddf.js\",\"8974\",\"static/chunks/app/page-dc38a96e83966032.js\"],\"HomePage\"]\n7:I[4062,[\"4219\",\"static/chunks/app/global-error-380a09a8d1da3544.js\"],\"default\"]\n8:I[4431,[],\"OutletBoundary\"]\na:I[5278,[],\"AsyncMetadataOutlet\"]\nc:I[4431,[],\"ViewportBoundary\"]\ne:I[4431,[],\"MetadataBoundary\"]\nf:\"$Sreact.suspense\"\n11:I[1968,[\"2619\",\"static/chunks/2619-3c9e02e22d10480a.js\",\"1356\",\"static/chunks/1356-6b403f2800ac3ddf.js\",\"4675\",\"static/chunks/4675-ef764ba709c860e8.js\",\"4115\",\"static/chunks/4115-35729b8a283b231c.js\",\"7177\",\"static/chunks/app/layout-fb8e9302f8dfbbf6.js\"],\"ConsentRoot\"]\n12:I[8658,[\"2619\",\"static/chunks/2619-3c9e02e22d10480a.js\",\"1356\",\"static/chunks/1356-6b403f2800ac3ddf.js\",\"4675\",\"static/chunks/4675-ef764ba709c860e8.js\",\"4115\",\"static/chunks/4115-35729b8a283b231c.js\",\"7177\",\"static/chunks/app/layout-fb8e9302f8dfbbf6.js\"],\"RecaptchaProvider\"]\n13:I[2260,[\"2619\",\"static/chunks/2619-3c9e02e22d10480a.js\",\"1356\",\"static/chunks/1356-6b403f2800ac3ddf.js\",\"4675\",\"static/chunks/4675-ef764ba709c860e8.js\",\"4115\",\"static/chunks/4115-35729b8a283b231c.js\",\"7177\",\"static/chunks/app/layout-fb8e9302f8dfbbf6.js\"],\"UtmCapture\"]\n14:I[4673,[\"2619\",\"static/chunks/2619-3c9e02e22d10480a.js\",\"1356\",\"static/chunks/1356-6b403f2800ac3ddf.js\",\"4675\",\"static/chunks/4675-ef764ba709c860e8.js\",\"4115\",\"static/chunks/4115-35729b8a283b231c.js\",\"7177\",\"static/chunks/app/layout-fb8e9302f8dfbbf6.js\"],\"SiteHeader\"]\n15:I[9766,[],\"\"]\n16:I[960,[\"2619\",\"static/chunks/2619-3c9e02e22d10480a.js\",\"8039\",\"static/chunks/app/error-3375bd2635d411f6.js\"],\"default\"]\n17:I[8924,[],\"\"]\n18:I[2619,[\"2619\",\"static/chunks/2619-3c9e02e22d10480a.js\",\"4345\",\"static/chunks/app/not-found-204f2e8031629712.js\"],\"\"]\n19:I[9144,[\"2619\",\"static/chunks/2619-3c9e02e22d10480a.js\",\"1356\",\"static/chunks/1356-6b403f2800ac3ddf.js\",\"4675\",\"static/chunks/4675-ef764ba709c860e8.js\",\"4115\",\"static/chunks/4115-35729b8a283b231c.js\",\"7177\",\"static/chunks/app/layout-fb8e9302f8dfbb"])</script>
2<script>self.__next_f.push([1,"f6.js\"],\"SiteFooter\"]\n1a:I[622,[],\"IconMark\"]\n:HL[\"/_next/static/media/36966cca54120369-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/e4af272ccee01ff0-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/css/531451b1c9bd3be4.css\",\"style\"]\n:HL[\"/_next/static/css/dd6b48e8ba8e96e8.css\",\"style\"]\n3:T7a3,"])</script>
2<script>self.__next_f.push([1,"{\"@context\":\"https://schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"What is Identity Security Posture Management (ISPM)?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"ISPM (Identity Security Posture Management) is the practice of continuously discovering, assessing, and hardening identity infrastructure - finding misconfigurations, excessive privileges, and attack paths before attackers exploit them. Forestall also operates as an IVIP (Identity Visibility and Intelligence Platform), providing deeper intelligence across human and non-human identities.\"}},{\"@type\":\"Question\",\"name\":\"Does Forestall require agents?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Forestall uses connector-based, read-only collection for posture analysis and does not require endpoint agents to deliver core identity visibility.\"}},{\"@type\":\"Question\",\"name\":\"Does it require elevated privileges?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Forestall is designed for least-privilege access patterns and read-only integrations aligned to enterprise security requirements.\"}},{\"@type\":\"Question\",\"name\":\"What outputs do teams get?\",\"acceptedA
2nswer\":{\"@type\":\"Answer\",\"text\":\"Teams receive prioritized risk views, fix-first remediation guidance, reporting exports, and evidence artifacts for audit and governance workflows.\"}},{\"@type\":\"Question\",\"name\":\"How does attack path analysis help prioritize fixes?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Attack path analysis reveals which identities and relationships create the shortest path to impact, so teams can fix the highest-leverage issues first.\"}},{\"@type\":\"Question\",\"name\":\"Which identity environments are supported?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Forestall supports hybrid and multi-cloud identity environments: Active Directory, Entra ID, Azure, Microsoft 365 (Teams, SharePoint), AWS IAM, Google Cloud IAM, and Google Workspace - all in one agentless, read-only platform.\"}}]}"])</script>
2<script>self.__next_f.push([1,"0:{\"P\":null,\"b\":\"VDfYdRwiHYIV0LlEvcjG4\",\"p\":\"\",\"c\":[\"\",\"\"],\"i\":false,\"f\":[[[\"\",{\"children\":[\"__PAGE__\",{}]},\"$undefined\",\"$undefined\",true],[\"\",[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/531451b1c9bd3be4.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"1\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/dd6b48e8ba8e96e8.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}]],\"$L2\"]}],{\"children\":[\"__PAGE__\",[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"script\",null,{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"$3\"}}],[\"$\",\"$L4\",null,{\"blogPosts\":[{\"slug\":\"sccm-cve-2026-47301\",\"title\":\"SCCM Console Extension Chain (CVE-2026-47301): From Domain User to SYSTEM on the Site Server\",\"date\":\"2026-08-13\",\"dateModified\":\"$undefined\",\"displayDate\":\"Aug 13, 2026\",\"category\":\"Threat Analysis\",\"author\":\"Forestall Research Team\",\"authorRole\":\"Security Research\",\"readTime\":\"15 min read\",\"excerpt\":\"CVE-2026-47301 is a broken authorization check in the Configuration Manager administration service: two console-extension upload paths, and only one of them verified that the caller held the Create permission. XM Cyber chains it with weak code-signing verification, a cabinet path traversal they call CabSlip, and an unverified secondary DLL load to reach code execution as SYSTEM on a primary site server. Microsoft's update closes the entry point, which leaves the operational question: who in your hierarchy still holds the permission that reaches the rest of the chain.\",\"tags\":[\"Configuration Manager\",\"SCCM\",\"CVE-2026-47301\",\"AdminService\",\"Console Extensions\",\"Privilege Escalation\",\"Detection Engineering\",\"Blue Team\",\"Active Directory\"],\"featured\":true,\"heroImage\":\"/images/blog/sccm-cve-2026-47301/hero.webp\",\"citations\":[{\"name\":\"Omri Baso (XM Cyber): From Domain User to Enterprise Control\",\"url\":\"https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca\"},{\"name\":\"XM Cyber: Potential for Remote Code Execution in Microsoft SCCM\",\"url\":\"https://xmcyber.com/blog/potential-for-remote-code-execution-in-microsoft-sccm-via-newly-discovered-exploit-chain/\"},{\"name\":\"Microsoft: CVE-2026-47301 Security Update Guide\",\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47301\"},{\"name\":\"NVD: CVE-2026-47301\",\"url\":\"https://nvd.nist.gov/vuln/detail/CVE-2026-47301\"},{\"name\":\"Microsoft: KB38232642 Security update for Configuration Manager Console Extension\",\"url\":\"https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2603/38232642\"},{\"name\":\"Microsoft: KB37864969 Second update rollup for Configuration Manager 2509\",\"url\":\"https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2509/37864969\"},{\"name\":\"Microsoft: What is the administration service in Configuration Manager?\",\"url\":\"https://learn.microsoft.com/en-us/intune/configmgr/develop/adminservice/overview\"},{\"name\":\"Microsoft: Import Configuration Manager console extensions\",\"url\":\"https://learn.microsoft.com/en-us/intune/configmgr/core/servers/manage/import-admin-console-extensions\"},{\"name\":\"Microsoft: Fundamentals of role-based administration for Configuration Manager\",\"url\":\"https://learn.microsoft.com/en-us/intune/configmgr/core/understand/fundamentals-of-role-based-administration\"},{\"name\":\"Microsoft: Plan for the SMS Provider\",\"url\":\"https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/hierarchy/plan-for-the-sms-provider\"},{\"name\":\"Microsoft: SMS_Admin server WMI class\",\"url\":\"https://learn.microsoft.com/en-us/intune/configmgr/develop/reference/core/servers/configure/sms_admin-server-wmi-class\"},{\"name\":\"Microsoft: How to set up the administration service\",\"url\":\"https://learn.microsoft.com/en-us
2/intune/configmgr/develop/adminservice/set-up\"},{\"name\":\"Microsoft: Configuration Manager log file reference\",\"url\":\"https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/hierarchy/log-files\"},{\"name\":\"CSO Online: It took $58 to break Microsoft's SCCM\",\"url\":\"https://www.csoonline.com/article/4209154/it-took-58-to-break-microsofts-sccm-but-a-patch-made-it-harder.html\"}],\"seoTitle\":\"CVE-2026-47301 SCCM Console Extension Chain: Detection Guide\",\"metaDescription\":\"CVE-2026-47301 lets a low-privileged user upload console extensions via SCCM AdminService. Detection queries, RBAC audit, and what July's fix left open.\"},{\"slug\":\"kerberloss-cve-2026-25177\",\"title\":\"KerberLoss (CVE-2026-25177): Invisible Unicode in Service Principal Names for DoS, Kerberos Downgrade, and SPN-Jacking\",\"date\":\"2026-08-07\",\"dateModified\":\"$undefined\",\"displayDate\":\"Aug 7, 2026\",\"category\":\"Active Directory\",\"author\":\"Forestall Research Team\",\"authorRole\":\"Security Research\",\"readTime\":\"11 min read\",\"excerpt\":\"KerberLoss hides an invisible Unicode character inside a Service Principal Name so that Active Directory's uniqueness check and its LDAP lookup disagree about which object owns the name. From that one trick an attacker can deny access to a service, silently downgrade Kerberos to NTLM, or hijack a service for a constrained delegation attack. Because the malicious SPN has to sit in the directory, it is also straightforward to hunt down.\",\"tags\":[\"Active Directory\",\"Kerberos\",\"CVE-2026-25177\",\"KerberLoss\",\"SPN\",\"Denial of Service\",\"NTLM Downgrade\",\"Detection Engineering\",\"Blue Team\"],\"featured\":true,\"heroImage\":\"/images/blog/kerberloss-cve-2026-25177/hero.webp\",\"citations\":[{\"name\":\"Semperis: Identity Crisis (KerberLoss and ResetNightmare)\",\"url\":\"https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/\"},{\"name\":\"Microsoft: CVE-2026-25177 Security Update Guide\",\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177\"},{\"name\":\"Microsoft: CVE-2021-42282 (name uniqueness hardening)\",\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42282\"},{\"name\":\"Microsoft: Service Principal Names\",\"url\":\"https://learn.microsoft.com/windows/win32/ad/service-principal-names\"},{\"name\":\"Microsoft: S4U2Self and S4U2Proxy (constrained delegation)\",\"url\":\"https://learn.microsoft.com/openspecs/windows_protocols/ms-sfu/3bff5864-8135-400e-bdd9-33b552051d94\"}],\"seoTitle\":\"CVE-2026-25177 KerberLoss: Unicode SPN Abuse and Detection\",\"metaDescription\":\"KerberLoss (CVE-2026-25177) uses invisible Unicode in servicePrincipalName to bypass SPN uniqueness, enabling DoS, Kerberos-to-NTLM downgrade, and SPN-jacking. Mechanism, impact, a Neo4j hunting query, and mitigation.\"},{\"slug\":\"resetnightmare-cve-2026-27912\",\"title\":\"ResetNightmare (CVE-2026-27912): Full Domain Takeover Through the Kerberos Change Password Protocol\",\"date\":\"2026-08-07\",\"dateModified\":\"$undefined\",\"displayDate\":\"Aug 7, 2026\",\"category\":\"Active Directory\",\"author\":\"Forestall Research Team\",\"authorRole\":\"Security Research\",\"readTime\":\"12 min read\",\"excerpt\":\"ResetNightmare lets a low-privileged user with write access over a single account reset a Domain Admin's password and take over the domain. It works by pushing a stolen ticket through the Kerberos change password protocol, which never performs the SID check that the 2021 sAMAccountName-spoofing patch added. The setup leaves one anomalous attribute behind, which is exactly what makes it possible to hunt for.\",\"tags\":[\"Active Directory\",\"Kerberos\",\"CVE-2026-27912\",\"ResetNightmare\",\"Privilege Escalation\",\"Domain Takeover\",\"Detection Engineering\",\"Blue Team\"],\"featured\":true,\"heroImage\":\"/images/blog/resetnightmare-cve-2026-27912/hero.webp\",\"citations\":[{\"name\":\"Semperis: Identity Crisis (KerberLoss and ResetNightmare)\",\"url\":\"https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/\"},{\"name\":\"Microsoft: CVE-2026-27912 Security Update Guide\",\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912\"}
2,{\"name\":\"Microsoft: CVE-2021-42287 (sAMAccountName spoofing / PAC)\",\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287\"},{\"name\":\"Semperis Community: ResetNightmare PoC\",\"url\":\"https://github.com/Semperis-Community/ResetNightmare\"},{\"name\":\"Microsoft: Password-change protocols in Windows\",\"url\":\"https://learn.microsoft.com/troubleshoot/windows-server/active-directory/password-change-mechanisms\"},{\"name\":\"IETF RFC 3244: Kerberos Change Password\",\"url\":\"https://www.ietf.org/rfc/rfc3244.txt\"}],\"seoTitle\":\"CVE-2026-27912 ResetNightmare: AD Domain Takeover and Detection\",\"metaDescription\":\"ResetNightmare (CVE-2026-27912) abuses the Kerberos change password protocol to bypass the PAC_REQUESTOR_SID check and reset any account's password. Attack mechanics, prerequisites, a Neo4j hunting query, and mitigation.\"}],\"jsonLd\":{\"@context\":\"https://schema.org\",\"@type\":\"SoftwareApplication\",\"name\":\"Forestall\",\"applicationCategory\":\"SecurityApplication\",\"operatingSystem\":\"Windows Server, Cloud\",\"description\":\"Agentless ISPM and IVIP platform for discovering identity misconfigurations, mapping privilege escalation paths, detecting shadow admins, and generating compliance evidence across on-prem and cloud identity - Active Directory, Entra ID, Azure, Microsoft 365, AWS IAM, Google Cloud IAM, and Google Workspace. No Domain Admin required.\",\"url\":\"https://forestall.io\",\"featureList\":[\"Identity Attack Surface Management\",\"Identity Risk Assessment\",\"Attack Path Management\",\"Compliance Reporting (ISO 27001, NIST, PCI DSS, SAMA, NCA ECC, UAE IAR)\",\"Credential Discovery\",\"Non-Human Identity (NHI) Coverage\",\"AI Agent Identity Coverage\",\"Shadow Admin Detection\",\"Tier-0 Asset Mapping\",\"Multi-Cloud Identity Coverage (AWS IAM, Google Cloud IAM, Google Workspace)\"],\"offers\":{\"@type\":\"Offer\",\"priceCurrency\":\"USD\",\"availability\":\"https://schema.org/OnlineOnly\",\"url\":\"https://forestall.io/company/contact-us\"},\"publisher\":{\"@id\":\"https://forestall.io/#organization\"}}}]],null,\"$L5\"]}],{},null,false]},null,false],\"$L6\",false]],\"m\":\"$undefined\",\"G\":[\"$7\",[]],\"s\":false,\"S\":false}\n"])</script>
2<script>self.__next_f.push([1,"5:[\"$\",\"$L8\",null,{\"children\":[\"$L9\",[\"$\",\"$La\",null,{\"promise\":\"$@b\"}]]}]\n6:[\"$\",\"$1\",\"h\",{\"children\":[null,[[\"$\",\"$Lc\",null,{\"children\":\"$Ld\"}],[\"$\",\"meta\",null,{\"name\":\"next-size-adjust\",\"content\":\"\"}]],[\"$\",\"$Le\",null,{\"children\":[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$f\",null,{\"fallback\":null,\"children\":\"$L10\"}]}]}]]}]\n"])</script>
2<script>self.__next_f.push([1,"2:[\"$\",\"html\",null,{\"lang\":\"en\",\"children\":[[\"$\",\"head\",null,{\"children\":[[\"$\",\"script\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}window.gtag=window.gtag||gtag;gtag('consent','default',{ad_storage:'denied',ad_user_data:'denied',ad_personalization:'denied',analytics_storage:'denied',wait_for_update:500});gtag('set','url_passthrough',true);try{var fsm=document.cookie.match(/(?:^|; )fs_cookie_consent=([^;]*)/);if(fsm){var fsc=JSON.parse(decodeURIComponent(fsm[1]));if(fsc\u0026\u0026fsc.categories){gtag('consent','update',{analytics_storage:fsc.categories.analytics?'granted':'denied',ad_storage:fsc.categories.marketing?'granted':'denied',ad_user_data:fsc.categories.marketing?'granted':'denied',ad_personalization:fsc.categories.marketing?'granted':'denied'});}}}catch(e){}\"}}],[\"$\",\"meta\",null,{\"property\":\"og:site_name\",\"content\":\"Forestall\"}],[\"$\",\"script\",null,{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"{\\\"@context\\\":\\\"https://schema.org\\\",\\\"@type\\\":\\\"Organization\\\",\\\"@id\\\":\\\"https://forestall.io/#organization\\\",\\\"name\\\":\\\"Forestall\\\",\\\"url\\\":\\\"https://forestall.io\\\",\\\"logo\\\":\\\"https://forestall.io/images/forestall_logo_black.svg\\\",\\\"description\\\":\\\"Agentless Identity Security Posture Management (ISPM) and Identity Visibility \u0026 Intelligence Platform for Active Directory, Entra ID, Azure, Microsoft 365, AWS IAM, Google Cloud IAM, and Google Workspace.\\\",\\\"foundingDate\\\":\\\"2020\\\",\\\"sameAs\\\":[\\\"https://www.linkedin.com/company/forestall-security\\\",\\\"https://www.youtube.com/@forestallsecurity\\\",\\\"https://x.com/forestallio\\\",\\\"https://www.crunchbase.com/organization/forestall\\\"],\\\"contactPoint\\\":{\\\"@type\\\":\\\"ContactPoint\\\",\\\"contactType\\\":\\\"sales\\\",\\\"url\\\":\\\"https://forestall.io/company/contact-us\\\"}}\"}}],[\"$\",\"script\",null,{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"{\\\"@context\\\":\\\"https://schema.org\\\",\\\"@type\\\":\\\"WebSite\\\",\\\"@id\\\":\\\"https://forestall.io/#website\\\",\\\"name\\\":\\\"Forestall\\\",\\\"url\\\":\\\"https://forestall.io\\\",\\\"description\\\":\\\"Agentless Identity Security Posture Management across on-prem and cloud identity - Active Directory, Entra ID, Azure, Microsoft 365, AWS IAM, Google Cloud IAM, and Google Workspace.\\\",\\\"publisher\\\":{\\\"@id\\\":\\\"https://forestall.io/#organization\\\"},\\\"potentialAction\\\":{\\\"@type\\\":\\\"SearchAction\\\",\\\"target\\\":{\\\"@type\\\":\\\"EntryPoint\\\",\\\"urlTemplate\\\":\\\"https://forestall.io/resources/faqs?q={search_term_string}\\\"},\\\"query-input\\\":\\\"required name=search_term_string\\\"}}\"}}]]}],[\"$\",\"body\",null,{\"className\":\"__variable_f367f3 __variable_dd5b2f\",\"children\":[\"$\",\"$L11\",null,{\"initialConsent\":null,\"children\":[\"$\",\"$L12\",null,{\"children\":[[\"$\",\"$L13\",null,{}],[\"$\",\"div\",null,{\"className\":\"site-shell\",\"children\":[[\"$\",\"$L14\",null,{}],[\"$\",\"$L15\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$16\",\"errorStyles\":[],\"errorScripts\":[],\"template\":[\"$\",\"$L17\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[\"$\",\"main\",null,{\"className\":\"not-found\",\"children\":[\"$\",\"div\",null,{\"className\":\"container\",\"children\":[[\"$\",\"p\",null,{\"className\":\"eyebrow\",\"children\":\"404\"}],[\"$\",\"h1\",null,{\"children\":\"Page not found\"}],[\"$\",\"p\",null,{\"children\":\"The page you’re looking for doesn’t exist or has been moved.\"}],[\"$\",\"$L18\",null,{\"href\":\"/\",\"className\":\"button button-primary\",\"children\":\"Back to Home\"}]]}]}],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}],[\"$\",\"$L19\",null,{}]]}]]}]}]}]]}]\n"])</script>
2<script>self.__next_f.push([1,"d:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}],[\"$\",\"meta\",\"2\",{\"name\":\"theme-color\",\"content\":\"#0b1620\"}]]\n9:null\n"])</script>
2<script>self.__next_f.push([1,"b:{\"metadata\":[[\"$\",\"title\",\"0\",{\"children\":\"Forestall | Identity Security Posture Management\"}],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"Discover identity exposures, prioritize risk, and reduce attack paths with Forestall - a safe, actionable approach to identity security posture management.\"}],[\"$\",\"link\",\"2\",{\"rel\":\"manifest\",\"href\":\"/manifest.webmanifest\",\"crossOrigin\":\"$undefined\"}],[\"$\",\"meta\",\"3\",{\"name\":\"robots\",\"content\":\"index, follow\"}],[\"$\",\"link\",\"4\",{\"rel\":\"canonical\",\"href\":\"https://forestall.io\"}],[\"$\",\"meta\",\"5\",{\"property\":\"og:title\",\"content\":\"Forestall | Identity Security Posture Management\"}],[\"$\",\"meta\",\"6\",{\"property\":\"og:description\",\"content\":\"Discover identity exposures, prioritize risk, and reduce attack paths with Forestall - a safe, actionable approach to identity security posture management.\"}],[\"$\",\"meta\",\"7\",{\"property\":\"og:url\",\"content\":\"https://forestall.io\"}],[\"$\",\"meta\",\"8\",{\"property\":\"og:image\",\"content\":\"https://forestall.io/images/platform-og.svg\"}],[\"$\",\"meta\",\"9\",{\"property\":\"og:image:alt\",\"content\":\"Forestall ISPM Platform\"}],[\"$\",\"meta\",\"10\",{\"property\":\"og:type\",\"content\":\"website\"}],[\"$\",\"meta\",\"11\",{\"name\":\"twitter:card\",\"content\":\"summary_large_image\"}],[\"$\",\"meta\",\"12\",{\"name\":\"twitter:title\",\"content\":\"Forestall | ISPM and Identity Visibility \u0026 Intelligence Platform\"}],[\"$\",\"meta\",\"13\",{\"name\":\"twitter:description\",\"content\":\"Forestall is an agentless ISPM and Identity Visibility \u0026 Intelligence platform. Discover identity exposures, map privilege escalation paths, and reduce risk across on-premises and multi-cloud identity - no Domain Admin required.\"}],[\"$\",\"meta\",\"14\",{\"name\":\"twitter:image\",\"content\":\"https://forestall.io/images/platform-og.svg\"}],[\"$\",\"meta\",\"15\",{\"name\":\"twitter:image:alt\",\"content\":\"Forestall identity security posture management platform overview\"}],[\"$\",\"link\",\"16\",{\"rel\":\"icon\",\"href\":\"/favicon.ico\",\"type\":\"image/x-icon\",\"sizes\":\"16x16\"}],[\"$\",\"link\",\"17\",{\"rel\":\"icon\",\"href\":\"/icon.png?0f0428ed34f6e98e\",\"type\":\"image/png\",\"sizes\":\"32x32\"}],[\"$\",\"link\",\"18\",{\"rel\":\"apple-touch-icon\",\"href\":\"/apple-icon.png?b67d017ec32b9ef1\",\"type\":\"image/png\",\"sizes\":\"180x180\"}],[\"$\",\"$L1a\",\"19\",{}]],\"error\":null,\"digest\":\"$undefined\"}\n"])</script>
2<script>self.__next_f.push([1,"10:\"$b:metadata\"\n"])</script>
2<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v4bc70e2c01a94c73b74392e4234840661791215815920" integrity="sha512-L0ha0OXavK/8okipN9F8BtP84dg9DUhPERbBXzwI6dgTA55d2+yweo3pn5CSFYs45/r8md2+xvUPtTdvTNRfjA==" data-cf-beacon='{"version":"2024.11.0","token":"7418675eb2534c869f8ce9235763856a","r":1,"spa":2}' crossorigin="anonymous"></script>
vendor: 1 bytes, line 2
2
3<script>(function(){function c(){var b=a.contentDocument||(a.contentWindow&&a.contentWindow.document);if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'a47366bf883e34ad',t:'MTc5MTQ0NDIxOA=='};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script>
3</body></html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.