Purple Knight

Active Directory security assessment: Purple Knight (Semperis) is a free assessment tool that safely queries an organization's Active Directory environment and runs a comprehensive set of tests against the most common and effective attack vectors to uncover risky configurations and security weaknesses.

Detection of AD security vulnerabilities and misconfigurations: The tool digs deeply into AD to surface dangerous misconfigurations, risky settings, and unpatched vulnerabilities that attackers could exploit to steal data or launch malware campaigns.

Indicators of Exposure (IoE) scanning: Purple Knight scans for indicators of exposure, the risky configurations and conditions that signal an environment is vulnerable to attack before any compromise has occurred, enabling proactive hardening.

Indicators of Compromise (IoC) scanning: The tool also scans for indicators of compromise that suggest an attack may already be underway or have occurred, helping defenders detect active threats in the directory.

Entra ID (Azure AD) security assessment: Beyond on-premises AD, Purple Knight assesses Entra ID (formerly Azure AD), checking cloud identity indicators such as privileged-account exposure, legacy authentication, MFA gaps, and risky application permissions.