What the free tier already gives your client, what PRO adds on top, and who each one is actually for.

Overview

ADscan ships in three tiers, and the line between them is not the report. It is what the report can tell someone to do.

LITE — free CLI engine. The full scan core, attack-path analysis, operator workflow, and a client-ready exposure report in HTML and PDF.
PRO — LITE plus the Client Deliverable Kit generated by adscan deliver: per-finding remediation, per-path evidence, conformance mapping, and your branding instead of ours.
Enterprise — the same engine on a schedule, so posture can be tracked over time instead of sampled once.

Put another way: LITE answers are we exposed, and how badly. PRO answers what exactly do we change, on which objects, in what order. Enterprise answers did it actually get better.

The LITE CLI is distributed under the Business Source License 1.1. PRO and Enterprise are commercial.

LITE — free CLI engine

Category	Features
Enumeration	DNS, LDAP, SMB, Kerberos, Nmap, delegations, privileges, MSSQL, ADCS, CVEs, GPP, trusts
Credential attacks	AS-REP roasting, Kerberoasting, password spraying, SAM/LSA/DCSync, hash cracking
Attack-path graph	Native LDAP graph collector + BloodHound-compatible JSON export per workspace
Attack graphs	Algorithmic attack-path generation, auto-exploitation chains
ADCS	Detection, template enumeration, ESC1-16 auto-exploitation
Post-exploitation	Post-DA enumeration, Backup/Account Operators escalation
Operations	Three modes (auto/semi/manual), CI/CD mode, workspaces
Export	TXT/JSON export, operator cheat-sheet PDF (`adscan cheatsheet`), MITRE ATT&CK Navigator layer (`adscan mitre-navigator`)

LITE ships eleven commands: start, ci, demo, tui, cheatsheet, mitre-navigator, welcome, check, install, update, version.

What LITE hands you at the end of a scan

Two artifacts, both free:

technical_report.json — every finding ADscan surfaces, raw and machine-readable. Pipe it into your own reporting: PwnDoc, your firm's template, whatever you already run.

The exposure report, written as a self-contained HTML file and as a PDF. The HTML opens with no network and survives being forwarded; the PDF is what gets through a mail gateway and in front of a board. It contains:

the posture score, with the reading that produced it
every finding, with the objects it affects — the accounts, hosts (by name and address), shares, files and certificate templates the finding is about, so the reader can go and look at them
the attack paths ADscan proved, each one validated by executing it rather than inferred from configuration
a ranked choke-point table: which fixes close the most paths, so the remediation argument is ordered before anyone has opened a ticket
a full disclosure of every change ADscan made to the directory during the scan, including anything it could not roll back automatically

That last one is not a nicety. If a tool creates a machine account or edits a template on a client's domain, the client is entitled to read that in the document you hand them, not discover it later.

The free report is deliberately complete for the question it answers. It is not a teaser with the interesting half removed.

PRO — the Client Deliverable Kit

PRO adds one command: adscan deliver. It turns the same workspace into the kit in about 90 seconds.

What it adds over the free report:

PRO adds	What that means on an engagement
Per-finding remediation	The exact native command against the exact object, plus the expected before and after, so the client's sysadmin can execute it without a translation meeting
Per-path evidence	A graph and a written narrative for each attack path, rather than a list of path names
Conformance mapping	Every finding mapped to the ENS, NIS2, ISO 27001, DORA and PCI DSS control sets, so the compliance reader can find their own row
Bonus documents	The hardening playbook with a 30-day plan, the control coverage report, and the ATT&CK Navigator bundle
White-labelling	Your firm's name and mark on the cover, not ours

The kit is three PDFs and one interactive bundle:

Document	Audience	Use case
Security Assessment Report	CISO / board	Posture score, findings, attack paths with per-path evidence, and the ATT&CK lens
AD Hardening Playbook	Security team lead	Remediation runbooks by finding ID, plus a 30-day prioritized plan
AD Control Coverage Report	Board / compliance	Which controls ADscan tested and what it found, mapped to the ENS, NIS2, ISO 27001, DORA and PCI DSS control sets
MITRE ATT&CK Navigator bundle	SOC / detection	Interactive ATT&CK layer + HTML viewer + diff vs the previous scan

# Full kit
adscan deliver --workspace acme.local --client "Acme Corp"

# Single PDF
adscan deliver --workspace acme.local --only playbook

# Subset
adscan deliver --workspace acme.local --only executive,checklist

Output: a ZIP at <workspace>/deliverables/<date>-adscan-kit.zip plus a manifest.json.

Full Client Deliverable Kit page

Who PRO is for, and what it is not

PRO is bought by the people who get paid for the engagement: consultancies, MSSPs, and independents who bill AD work. The free report is what your client reads; the kit is what makes it worth what you charged for it.

One thing it is not: a conformity certificate. A conformance mapping tells a compliance reader which controls a finding touches. It is not an accredited opinion, and ADscan does not issue one. Certification under ENS MEDIA/ALTA or ISO 27001 runs through accredited bodies, which we are not and will not be. What PRO produces is the technical work that sits either side of that audit.

PRO beta

Get PRO free for your next engagement.

Thirty days, no card. The deal is explicit: run it on real client work, then tell us what broke and what was missing. A short testimonial if it earns one.

We pay in access rather than charge, because while PRO is pre-1.0 the feedback of someone billing AD work is worth more to us than the licence fee. That stops being true the day it is priced.

Request beta access

No card · Reply same day

Not ready to ask for anything? Run a scan on LITE and read the free report first. Same engine, and it is the honest way to find out whether the paid half is worth your time. LITE quickstart.

Enterprise — CTEM web

A web platform for continuous threat exposure management. Where PRO produces one excellent snapshot, Enterprise produces the sequence: the same validation on a schedule, so a fix can be shown to have held.

Feature	Details
Continuous AD monitoring	Scheduled scans with drift detection
Web dashboard	Centralized view of all domains
Risk scoring & trends	Track security posture over time
Team collaboration	Multi-user with role-based access
Priority support	1:1 onboarding and dedicated support

Licensing

LITE is distributed under the Business Source License 1.1:

Read, use, and modify the code freely
Use for pentesting (personal or paid client engagements)
Cannot create a competing commercial product
Converts to Apache 2.0 on 2029-02-01

PRO and Enterprise are distributed under a separate commercial license.

Current availability

PRO is in beta and free for 30 days to consultants running real AD engagements, in exchange for feedback and a testimonial if it delivers. Request it at adscanpro.com/pro or by mail to [email protected].

Enterprise CTEM is in validation. We run a live assessment in your environment (a 1-2h session over VPN) so you can see the platform working before committing. Request it at adscanpro.com/get-a-demo.

LITE vs PRO