Forestall ISPM - Identity Security Posture Management

Disrupt the adversaries' identity kill chain across on-premises and cloud

Forestall ISPM reveals your organization's identity security posture before the attacker does, and helps you take the necessary precautions with on-demand or scheduled assessments. It analyzes Active Directory and four cloud and SaaS providers in one product:

Provider	What is analyzed
Active Directory	Forests, domains, users, computers, groups, GPOs, AD Certificate Services, local accounts, shares
Azure	Entra ID, Azure Resource Management, Microsoft Teams and SharePoint Online
AWS	IAM, Organizations and IAM Identity Center
GCP	Google Cloud IAM, projects and resources, and Google Workspace
GitHub	Enterprises, organizations, organization roles, users, teams, repositories and app installations

Identity Inventory

Forestall collects in-depth information about the objects of each provider and the relationships between them. Some of the analyzed Active Directory objects are:

• Users

• Computers

• Groups

• Group Policy Objects

• Organizational Units

• Service Accounts / Managed Service Accounts (MSA, gMSA, dMSA)

• Service Principal Names

• Access Control Entries

• Local Groups

• Local Users

• Network Shares

Objects from all providers are listed under Unified Identities in Human Identities, Non Human Identities, Resources and Group views. Identities that belong to the same person, such as an AD user and its synchronized Entra ID account, are correlated into a single unified identity by configurable merge rules. Every object can be filtered, exported and queried with Search & Reports. For example, you can list:

• Privileged users and groups

• Disabled/locked users

• Service users

• Organizational Units with no members

• Users with local administrator privileges

• Computers/users with most sessions

• Group Policies with no linked entities

Vulnerability Assessment

Forestall detects provider-specific vulnerabilities and misconfigurations with its Vulnerability Detection Engine. Each finding is an issue with an ID that starts with the provider's block: FS1xxx for Active Directory, FS2xxx for Entra ID and Azure, FS3xxx for Teams and SharePoint, FS4xxx for AWS, FS5xxx for GCP and FS6xxx for GitHub. Custom tags are added to issues for easier categorization.

Issue documentation in the product contains the information below to accelerate identification, remediation, detection, and prioritization.

• Severity, Ease of Mitigation and Ease of Detection metrics for prioritization

• Issue description, impact, and references

• Manual identification methods

• Detailed mitigation plans and scripts for automated remediation

• Exploitation detection methods with event log IDs and attributes

• MITRE ATT&CK matrix mapping for suitable issues

• Mapping to twelve compliance frameworks on the Compliance page

After fixing an issue, a Remediation Scan re-checks only the selected findings instead of running a full scan.

Actionable Remediation Roadmaps against Impacts

Forestall generates a remediation roadmap by aggregating the issues that create critical attack vectors under Impacts and reveals which attacks the organization can be affected by. You can then act on whole attacks and emerging identity threats, not only on single issues.

Identity Security Graph

When the scan is finished, Forestall builds a security graph of all collected objects and their relationships, including relationships that cross from Active Directory to the cloud. Use manual or built-in queries in the Graph to find abnormal relationships, shortest lateral movement and privilege escalation paths, Shadow Admins and misconfigured access control entries. Tier0 Analysis shows which objects can reach Tier 0.

Some of the built-in queries in the Graph module:

• Objects with DCSync rights

• Non-built-in admin objects with WriteDACL rights

• Administrator sessions to non-Domain Controllers

• Groups with local administrator rights

• Shortest path to admin groups

• Abnormal rights which Domain Users should not have

Focused Audits

• GPO Audit: Group Policy analysis, baselines and RSoP comparison.

• CAP Audit: Entra ID Conditional Access Policy gap analysis, ineffective and duplicate policies.

• Credential Discovery: secrets found in SMB shares.

• Trend Insights: how risk and findings change across scans.

Reporting

When a scan is finished, Forestall generates an Executive Summary (PDF), a Full Report (PDF) and an offline Report Package (ZIP) with the report and its affected-object evidence. Branding, cover page and executive summary are set in Report settings, and reports can be regenerated from the scan list.

AI Assistant and REST API

The AI Assistant answers questions about Forestall and your scan data in natural language, using a cloud or self-hosted AI provider that you configure.

Forestall provides a REST API for automation and extensibility, and an MCP server for AI clients. See API Reference and API Tokens.

Deployment

Forestall is installed on a single Windows server in your network and needs no agents. Active Directory is scanned directly from that server. Cloud providers are scanned through their APIs, which requires outbound HTTPS access. See Architecture and Requirements.