Your Active Directory controls access to your entire company. Find out who could compromise it, and how to stop them.
ShieldAD audits your Active Directory and Microsoft Entra ID on your premises, in read-only mode. One scan gives you the weaknesses that can really be exploited, ranked by priority, fixes you can apply without breaking production, and the evidence for your audits: NIS2, ISO 27001, CyFun and 4 other frameworks.
- Read-only
- No data leaves your infrastructure
- Built in Brussels
Why Active Directory is attackers' first target
Active Directory decides who can access what: workstations, servers, email, business applications. An attacker who takes control of it takes control of the whole company. It is the key step in most ransomware attacks.
Invisible weaknesses
After years of changes, forgotten accounts, inherited rights and outdated settings pile up. Nobody sees them, except an attacker.
Too many alerts, no priorities
Traditional audit tools produce hundreds of alerts without saying which ones are truly dangerous or how to fix them safely.
Obligations that require evidence
NIS2, ISO 27001, CyFun, DORA: being secure is no longer enough, you have to be able to prove it.
From diagnosis to compliance evidence, in one platform
See
A clear security score and a map of the paths an attacker would take to reach administrator accounts (ShieldGraph).
Prioritise
Every weakness is ranked by real risk, ease of exploitation and impact on your business. You know where to start.
Fix
For every weakness: a step-by-step fix plan, a ready-to-use PowerShell script, and a simulation of what the fix could break before you apply it (ShieldPredict Professional plan).
Prove
Every control is mapped to NIS2, ISO 27001, CIS, GDPR, CyFun, DORA and ANSSI requirements. Your reports are auditor-ready.
One scan, a report for every decision-maker
Management
Your risk level on one page, without jargon, with the business impact.
IT Manager / CISO
The prioritised list of fixes, with scripts and estimated effort.
DPO / Compliance
The mapping to NIS2, GDPR and ISO 27001 requirements, and the evidence to keep.
External auditors
A multi-client tool for your NIS2 and ISO 27001 engagements (Auditor plan).
Four steps. Nothing to install. Nothing leaves your premises.
We come to you.
Before launch, your security officer checks with us that the software is genuine and untampered (SHA-256 fingerprint).
The scan analyses without changing anything.
It runs read-only on Active Directory and Entra ID, in minutes, with no agent installed.
You receive 8 reports.
Executive, IT, DPO, remediation, scoring, trend, users at risk, AD forest.
You fix, with guidance.
Ready-to-use scripts, and the next scan measures your progress.
Verified before every scan. Read-only. On site. Your data stays with you.
Every ShieldAD scan starts with a software integrity check, performed live in front of your security officer. The analysis changes nothing in your environment, and no Active Directory data passes through our servers: this is guaranteed by the architecture, not just by contract.
On-site validation
The software's SHA-256 fingerprint is checked in front of you before every scan.
Zero exfiltration
Everything runs locally. Results stay inside your infrastructure.
Measured progress
Every scan compares your results with the previous one: applied fixes and resolved controls show up automatically in the next report.
The actual product
Real screenshots, not illustrations: dashboard, scan, attack paths, SIEM export.
The Dashboard shows your global Identity Security Score, a FAIL/WARN/PASS breakdown and your top prioritized risks.
The Scan screen launches an on-premises Active Directory scan or an Azure/Entra ID scan, plus an IAM access inventory.
ShieldGraph visualizes attack paths, showing privilege escalation routes and choke points toward Domain Admins.
ShieldConnect sends results to your SIEM or SOAR: Microsoft Sentinel, Splunk, Elastic, Wazuh, Graylog, IBM QRadar, Teams and Slack.
ShieldConnect sends results to (Professional plan, JSON/CEF export):
Before. After.
Toggle a real finding to see the fix, the residual risk and the compliance gain.
Security issue FAIL
Kerberoastable privileged service accounts detected
Service accounts with a Service Principal Name (SPN) can have their Kerberos service ticket requested by any authenticated user and cracked offline. Weak encryption and predictable passwords increase the probability of credential theft and lateral movement.
Get-ADUser -Filter 'ServicePrincipalName -like "*"' -Properties ServicePrincipalName,AdminCount,'msDS-SupportedEncryptionTypes' | Where-Object AdminCount -eq 1
Set-ADUser -Identity svc-app -Replace @{'msDS-SupportedEncryptionTypes'=24}
Security issue PASS
Privileged service accounts now enforce AES-only Kerberos encryption
The account's msDS-SupportedEncryptionTypes attribute was set to AES128+AES256 only, removing the weak-encryption path used for offline Kerberoasting. Where possible, the account was migrated to a group managed service account (gMSA) with an auto-rotated password, removed from privileged groups it no longer needed, and its unused SPNs were deleted.
Get-ADUser -Filter 'ServicePrincipalName -like "*"' -Properties 'msDS-SupportedEncryptionTypes' |
Where-Object { $_.'msDS-SupportedEncryptionTypes' -eq 24 }
Regulatory Compliance
Fix it once. NIS2, ISO 27001, CIS, GDPR, DORA and ANSSI move together.
Fix the technical control once, then reuse the evidence across multiple compliance views.
- Privileged access management
- Incident notification (24h / 72h / 1 month)
- Vulnerability management
- Business continuity
- Access control (A.5.15)
- Cryptography (A.8.24)
- Logging and monitoring (A.8.15-A.8.16)
- Incident management (A.5.24)
- Account management (CIS 05)
- Access management (CIS 06)
- Audit log management (CIS 08)
- Application security (CIS 16)
- Access traceability
- Lifecycle management
- Least privilege
- Log management
- Asset identification
- Authentication protection
- Anomaly detection
- Incident response
- ICT risk management
- Resilience testing
- Incident management
- Third-party oversight
- Domain controller hardening
- FSMO & SPOF separation
- Tiering model
- PAM recommendations
Legal notice: ShieldAD provides evidence of technical controls and does not constitute NIS2, ISO 27001 or GDPR certification. Regulatory compliance requires additional documentary assessment by a qualified auditor. DORA (EU 2022/2554) applies exclusively to EU financial entities. Read our full Security & Compliance policy.
Transparent Pricing
Four plans, from a one-time audit to an unlimited annual license
Oneshot
A snapshot of your Active Directory, carried out on site by our team. For 20 to 249 users. No subscription, no software licence included.
- Full on-prem + cloud scan (524 controls)
- All 8 HTML reports delivered
- On-site SHA-256 validated execution
- Expert debrief & report walkthrough
Payable in full when you order, before the intervention.
Book a meetingEssential
Annual software licence with 4 scans a year, launched by your team. For 20 to 249 users.
- Software licence + 4 scans a year, launched by you
- Full scan (524 controls), 8 reports, SHA-256 check before each scan
- Trend report: track security evolution over time
- Software update access included
- Controls mapped to NIS2, ISO 27001, GDPR, CIS, DORA, ANSSI
- Email support included
Minimum billed: 20 users (€580 excl. VAT/year). 12-month commitment.
Book a meetingProfessional
Annual licence with unlimited scans and ShieldConnect SIEM export. For 20 to 249 users.
- Unlimited scans during subscription period
- All 524 controls + 8 reports
- Multi-domain Active Directory
- SIEM connectors included: ShieldConnect (Sentinel, Splunk, Elastic, Wazuh, Graylog, QRadar, Teams, Slack; JSON/CEF export)
- ShieldPredict included: attack impact simulation before remediation
- Priority phone + email support + premium product updates
Minimum billed: 20 users (€980 excl. VAT/year). 12-month commitment.
Book a meetingRoadmap (upcoming):
ShieldBrand: custom brandingAuditor
For external auditors & pentesters. NIS2, ISO 27001. Pay per scan pack.
- Scan packs: 5, 10 or 20 scans
- Full scan + all 8 reports per audit
- Multi-client use
- Pack valid up to 18 months
A user = an active named user account in your directory. Service and shared accounts are not counted.
- All prices are ex-VAT: VAT applies as per applicable legislation
- Oneshot: payable in full when you order, before the intervention.
- Payment terms: 30 days net
- Essential & Professional subscriptions billed annually
- Auto-renewal for successive 1-year terms unless notified 30 days in advance
- Custom quote within 48 business hours
Frequently Asked Questions
Find quick answers to the most common questions
ShieldAD Report™ is an Active Directory and Entra ID audit platform. From a single read-only scan, it produces 8 distinct reports (executive, IT manager, DPO/GDPR, remediation, detailed scoring, trend, users at risk, AD forest) covering 524 security controls: 356 on-premises Active Directory and 168 Entra ID.
No. The scan runs in read-only mode, without installation, without modifying the infrastructure. Data does not leave the client's environment. The self-contained PowerShell agent runs on any Windows environment from Server 2016 onwards. No Active Directory data transits to our servers: this is guaranteed architecturally, not contractually.
The Oneshot is always carried out on site by our team. Deploying a security tool on a domain controller without being physically present to validate its integrity and walk you through the reports misses the point of an audit: the SHA-256 validation of the executable, performed live with your CISO before launch, is the foundation of trust. With the Essential and Professional subscriptions, your team runs the scans itself, in read-only mode, after checking the SHA-256 fingerprint of the executable.
Operating system: Windows 10/11 (64-bit) or Windows Server 2016/2019/2022/2025. The EXE is compiled as x64: it will not run on a 32-bit system.
PowerShell: Windows PowerShell 5.1 minimum (included natively on Win10/11 and Server 2016+). PowerShell 7+ (Core) is not supported. Native Windows PowerShell only.
RSAT: The ActiveDirectory PowerShell module must be installed on the machine running the scan. On Windows 10/11: Settings › Apps › Optional features › RSAT: Active Directory Domain Services and LDS Tools. On Windows Server: Install-WindowsFeature RSAT-AD-PowerShell
Network & AD rights: The machine must be a member of the domain being audited. A domain controller reachable on the network (ports LDAP 389, Kerberos 88, RPC 135). An account with Active Directory read rights (Domain Admin recommended for a full scan).
Execution rights: Run the EXE "as administrator" (it automatically requests UAC elevation).
Output folder: Write access to Documents\ShieldAD (created automatically): HTML reports are generated there.
Optional (AADS cloud module): Only required if scanning Entra ID / Azure AD: Install-Module MSAL.PS -Scope CurrentUser, .NET Framework 4.6.1+ (native on Win10/Server 2016+), an Azure account with read-only Graph permissions on the tenant (admin consent required), internet access for Microsoft Device Code Flow (no secret stored, authentication in memory only).
Yes. ShieldAD's 524 controls are mapped, wherever a requirement applies, to the relevant NIS2 article (EU Directive 2022/2555) and to the relevant Annex A controls of ISO/IEC 27001:2022 (93 controls across the Organizational, People, Physical and Technological themes, A.5 to A.8). The management report generates an Art. 21 compliance summary for auditors. We also cover CIS Controls v8.1, GDPR, CyFun (Belgium), DORA (financial sector) and the ANSSI guide for Active Directory hardening. ShieldAD does not, by itself, confer NIS2 compliance or ISO 27001 certification: these require an organizational assessment by a qualified auditor.
We offer four plans:
Oneshot (€500 excl. VAT) is a snapshot of your Active Directory, carried out on site by our team: you receive the 8 reports, not the software. For 20 to 249 users, with no subscription.
Essential (€29 excl. VAT per user per year) gives you the software licence, 4 scans a year launched by your team, trend reporting and software update access.
Professional (€49 excl. VAT per user per year) adds unlimited scans, ShieldConnect (8 SIEM, messaging and email connectors: JSON/CEF export) and ShieldPredict attack simulation. The Entra ID / Azure AD module is included in every plan.
Essential and Professional are billed on a minimum of 20 users (€580 and €980 excl. VAT per year), with a 12-month commitment. From 250 users, all plans, Oneshot included, are priced on quote.
Auditor is designed for external NIS2 / ISO 27001 auditors and pentesters, purchased as scan packs of 5, 10 or 20 scans, usable across multiple client environments.
Contact us to discuss which plan matches your security maturity and regulatory obligations.
A user = an active named user account in your directory. Service and shared accounts are not counted. Each named account counts separately: a person with a standard account and an administration account counts as two users. An account synchronised between Active Directory and Entra ID is counted once. Essential and Professional are billed per user per year, with a minimum of 20 users billed. The number of users can be checked with the user count produced by the ShieldAD scan, and is adjusted at each renewal: nothing extra is invoiced during the current term.
We do not offer free trials due to the sensitive nature of Active Directory audits. However, we organize personalized appointments to present the platform, answer your specific questions and assess your needs. Contact us at contact@mandatoryshield.com to schedule a discussion with our experts.
For the Oneshot, once your order is paid, we schedule the on-site intervention within 5 to 10 business days. The scan and the report delivery take place during this visit. For Essential and Professional, your team runs the scans itself once the contract is signed and the licence delivered: 4 scans a year with Essential, unlimited scans with Professional. The Auditor plan works per scan pack.
Yes. The Entra ID / Azure AD module is included in all plans at no extra cost. It analyzes your Microsoft cloud environment, Azure AD Connect synchronizations and federation configurations, and produces a dedicated report alongside the on-premise AD audit.
Shield modules are included in the Professional plan at no extra cost.
ShieldConnect sends scan results directly to your SIEM (Sentinel, Splunk, Elastic, Wazuh, Graylog, QRadar), messaging tools (Teams, Slack) and email, in JSON or CEF format. 8 connectors included.
ShieldPredict simulates attack scenarios based on your current AD posture, scoring risks by exploitability and business impact rather than generic CVE scores.
ShieldBrand, which will let MSPs and integrators deliver ShieldAD reports under their own brand identity, is planned for a future release and not yet available.
Contact us at contact@mandatoryshield.com to discuss availability.
Yes. The Auditor plan is specifically designed for external NIS2, ISO 27001 auditors, and pentesters who need to run AD security assessments across multiple client environments.
Instead of an annual subscription, you purchase a scan pack (5, 10 or 20 scans). Each scan includes the full 524-control analysis and all 8 regulatory reports. Packs are valid for up to 18 months and can be used across different client Active Directories.
Contact us at contact@mandatoryshield.com to discuss Auditor pricing.
No. ShieldAD is the platform: the assessment engine and its 8 reports. ShieldConnect and ShieldPredict are modules bundled into the Professional plan at no extra cost, not standalone products you install separately. ShieldBrand is on the roadmap and not yet available.
Who we are
Mandatory Shield Company, founded in Brussels in 2026, develops ShieldAD, an Active Directory audit solution designed for European SMEs and mid-sized companies. ShieldAD produces a complete report in under 10 minutes covering 524 security controls, aligned with NIS2, ISO 27001, CIS and GDPR, including ready-to-use PowerShell remediation scripts. No data leaves the client's infrastructure: everything runs locally, in read-only mode.
Our Mission
Enable every European organization to understand and reduce its Active Directory attack surface, whatever its size, without sending data outside its own infrastructure.
Built in Belgium
Developed in Brussels since 2026. Hosted in the EU. No third-party cloud dependency.
SHA-256 validation on site
The executable's hash is checked live in front of your CISO before every scan.
Actionable remediation
Every finding ships with a ready-to-use PowerShell remediation script.
Contact
Book a Meeting
Let's discuss your Active Directory security needs. Our experts will contact you within 48 business hours to arrange an appointment.
contact@mandatoryshield.com
www.mandatoryshield.com
Brussels, Belgium (European Union)