attack-map
How Microsoft 365 and Active Directory environments actually get breached, as one map: 23 techniques in five stages, from the first phish to the ransom note. Switch on the controls you have and watch which routes stay open.
technique detail
what to fix first
Ranked by how many open routes each control removes, per control you have to switch on. Some controls only close a technique together with another one, so they are offered as a pair.
full roadmap
your controls
Tick what is really enforced for everyone, not what is planned or in report-only mode. Start from a preset:
how to read this
| State | Meaning |
|---|---|
| exposed | None of the controls that matter for this technique is on. |
| reduced | Something makes it harder or easier to detect, but an attacker can still succeed. Several techniques can never be more than reduced. |
| closed | A control, or a combination of controls, blocks the technique as described. An open route is a chain from an entry point to an impact that passes only through techniques that are not closed. |
This is a model, and a deliberately simple one. Real controls have exclusions, break-glass accounts and misconfigurations, and real attackers combine techniques in ways a map with 23 nodes cannot show. Use it to find the gaps worth an afternoon, and to explain to someone why MFA alone is not the end of the story. Technique IDs link to MITRE ATT&CK and were checked against ATT&CK v19; the stage names are ours, not MITRE tactics.
Related: CA policy analyzer sign-in analyzer security self-check war stories