Your board is now personally accountable for the ransomware path you cannot see.
ADscan measures your ransomware exposure — every route from a low-privilege user to full domain takeover in your Active Directory — proves it by exploiting it, and maps each one to the DORA article your supervisor will ask about. On-premise. Open-source engine.
A pentest is a photo. Your Active Directory is a film.
A TLPT cycle runs every three years. An annual pentest covers one day out of 365. Your Active Directory changes every day a privilege is granted, a service account is created, a delegation is set. ADscan watches the surface that ransomware actually uses, continuously.
Measure
Map every path from an ordinary domain user to full control of the domain (Tier 0), the way an attacker enumerates it after the first foothold.
Prove
Exploit each path end to end, so the finding is a demonstrated fact, not a theoretical misconfiguration on a slide.
Map
Tie each proven path to the DORA article it touches, producing evidence your supervisor and your board can read without a translator.
For a financial entity, the exposure is not just data. It is the institution.
Article 5 names the management body.
DORA puts ICT risk on the board itself, and Article 50 reaches individuals. "We had an annual pentest" is no longer a defensible answer when the path was live for months.
Ransomware halts settlement.
A domain takeover does not leak a spreadsheet. It encrypts core banking, custody and payment systems. For a cooperative bank or a mutual, that is existential, not a fine line item.
The auditor wants evidence, not assurances.
Testing requirements under Articles 24 to 26 expect proof. A continuous, exploited, article-mapped record is the artifact that answers the question before it is asked.
Every proven path lands on a DORA article.
The report your supervisor receives is not a vulnerability dump. Each finding is already mapped to the obligation it satisfies, so the evidence trail writes itself.
Governance & management body
ICT risk management
Learning & evolving
Digital operational resilience testing
“In the 6 regulated entities where I ran it, 100% had at least one path to full domain takeover. One had gone undetected through two years of annual pentests.”
Built for an institution that cannot let its data leave.
ADscan runs inside your perimeter. The Active Directory data that defines your attack surface never reaches a third-party cloud, which is exactly the posture a DORA-supervised entity needs to be able to attest.
- On-premise appliance. AD data never leaves your infrastructure.
- Open-source engine. The exploitation logic is inspectable, not a black box.
- Continuous scheduled scans with finding lifecycle and SIEM webhooks.
- DORA, NIS2 and ENS reports generated from the same evidence.
A free Proof of Value. We find your paths to Tier 0, live, this quarter.
Yeray connects over VPN, runs ADscan against your Active Directory, and delivers the DORA-mapped report the same day. You never touch the platform.
Live assessment
A 1 to 2 hour session where we run the engine against your real domain and map the paths as they surface.
Included freeDORA-mapped report
Every proven path tied to its article, written for both your board and your supervisor.
Delivered same dayRemediation priority
The paths ordered by how directly they reach Tier 0, so your team fixes what closes ransomware first.
Included freeIf we cannot show you a path we can exploit, you owe us nothing and you keep the report. We are this confident because, so far, we have not failed to find one.
Limited to a small number of free assessments per quarter, in exchange for a testimonial.
- You give: VPN access for one session and honest feedback.
- You get: a proven, DORA-mapped picture of your ransomware exposure, same day.
- No procurement, no platform rollout, no commitment to continue.
This is the entry point to continuous CTEM, not a sales call. You leave with the evidence either way.
The questions a CISO asks before saying yes.
We already do a TLPT and an annual pentest. Why add this?
Both are point-in-time. A TLPT cycle is every three years, a pentest one day out of 365. Active Directory changes daily. ADscan covers the surface in between, which is exactly the surface ransomware exploits. One of the six entities we tested had a live path that two years of annual pentests had missed.
Will our Active Directory data leave our network?
No. ADscan is an on-premise appliance. The engine runs inside your perimeter and the AD data never reaches a third-party cloud, so the deployment posture is itself attestable under DORA.
Is this a Pentera or BAS replacement?
It is the Active Directory specialist. Generalist BAS platforms spread across web, cloud and external surfaces. If AD is your ransomware-bearing surface and you need on-premise, open-source, DORA-mapped proof, ADscan is the sharper fit. See the comparison for the honest version.
What does the board actually receive?
A single exposure metric they can track quarter over quarter: the number of live, exploited paths to full domain control, each tied to its DORA article. It is the artifact that turns "we are managing ICT risk" into evidence.
Find the path before your supervisor, or an attacker, does.
A free, live assessment of your ransomware exposure, mapped to DORA, delivered the same day. No platform to learn, no procurement to start.