Automated Active Directory pentest with MITRE-mapped compliance reports. Docker-based and self-hosted — scan data and client artifacts stay on your machine.

PRO access · beta partner

The Docker image is served from GitHub Container Registry: we grant your GitHub account read access, and your partner tag arrived in your onboarding email. Anything blocking, reach us on Discord or at [email protected] — same-day response.

ADscan PRO extends the free CLI with a professional report engine. Run the same AD pentest you already know — get a client-ready PDF and structured JSON out the other side.

What PRO adds

Feature	LITE (free)	PRO
AD enumeration and exploitation	Yes	Yes
Attack path generation	Yes	Yes
Raw JSON export	Yes	Yes
Exposure report (HTML + PDF)	Yes	Yes
Client Deliverable Kit — three PDFs plus the ATT&CK Navigator bundle	—	Yes
Compliance mapping (ENS, NIS2, ISO 27001, DORA, PCI DSS)	—	Yes
Per-finding remediation roadmap	—	Yes
Attack-path diagrams	—	Yes
Premium report themes	—	Yes
`--display-name` for client branding	—	Yes
Re-render deliverables from an existing workspace	—	Yes

Quick start

1. Pull from the registry

docker login ghcr.io with your GitHub PAT, then adscan update to pull the PRO image

2. Start PRO + partner tag

adscan start — enter your partner tag once, then the REPL walks every phase. deliver packages the PDFs

3. Understand the outputs

What's in the PDF, what's in the JSON

Unattended runs

adscan ci — the non-interactive entry point, for pipelines and batched engagements

Supported compliance frameworks

Key	Framework	Primary use case
`iso27001`	ISO/IEC 27001:2022	Certification audits, MSSP quarterly compliance
`ens`	ENS Alto (CCN-CERT)	Spanish public sector
`nis2`	NIS2 — EU Directive 2022/2555	EU critical-infrastructure operators
`dora`	DORA EU 2022/2554	EU financial entities
`pci_dss`	PCI DSS v4.0.1	Card-handling environments

Combine them in one report: --frameworks iso27001,dora.

No framework is selected by default. Name the regimes the client needs, or the Control Coverage Report renders with no compliance mapping.

How it fits your workflow

ADscan PRO is designed for pentesters and MSSPs running compliance engagements.

The typical flow (interactive — recommended):

1. adscan start — interactive REPL, the same flow you know from LITE
2. Walk each phase: recon → kerberos → ACL → attack-path collection → exploitation
3. deliver --display-name "Client Name" — packages the kit in about 90 seconds
4. PDFs → hand to the client, or attach to your engagement report
5. JSON → ingest into your own reporting pipeline

For batched or scheduled runs, adscan ci runs the same pipeline unattended.

The JSON output is structured and stable — designed to be parsed, not just read.

What does leave the machine

Scan output, credentials and the deliverables stay local. The Community and PRO command-line tools do upload pseudonymized usage telemetry and session recordings by default; the telemetry page states exactly what that contains and how to switch it off. The Enterprise appliance is the opposite — air-gapped, sending nothing.

Support

Discord: discord.com/invite/fXBR3P8H74 — fastest response
Email: [email protected]
Response SLA (beta): same day for blockers, 24h for everything else

ADscan PRO