Netra
The identity control plane is the new perimeter.
Netra gives forensic-grade visibility into the Tier-0 attack paths that bridging on-premise Active Directory and Entra ID creates, and helps you close them before an attacker finds them.
Netra maps recursive permission paths to Tier-0 so you can close them.
Ransomware operators often move through Active Directory misconfigurations. Hardening your identity core takes those routes away.
Find shadow admins and hidden Graph API scopes that act as permanent backdoors.
NetraBot runs on your appliance, so identity data stays inside your network.
Ransomware doesn't hack. It enumerates.
No zero-days, no malware, no alerts. Attackers abuse identity: delegated permissions, nested groups, legacy ACLs, stale service accounts and Entra ID role inheritance. If there is a path to Tier-0, they will find it.
Close the paths, not just detect them
Attack path discovery
Graph every privilege escalation path across AD and Entra ID, including the ones buried in inheritance and delegation.
Tier-0 focus
No noise and no vanity findings: just the shortest paths to Domain Admin and control-plane roles.
Proactive hardening
Remove permissions, collapse paths and harden identity before exploitation.
What Netra looks for
Active Directory
- ADCS certificate template misconfigurations (ESC1 to ESC8), such as enrollee-supplied subjects with risky EKUs.
- Unconstrained delegation: computers that can cache any user's ticket, and hop points to the domain controllers.
- Legacy Group Policy Preferences passwords (cpassword) in SYSVOL.
- AdminSDHolder protections, shadow credentials, domain-level policy and admin-session hygiene.
- Recursive ACL paths, nested groups and shadow admins that chain to Tier-0.
Entra ID and the hybrid bridge
- Dangerous Microsoft Graph permissions, such as RoleManagement.ReadWrite.Directory or AppRoleAssignment.ReadWrite.All, that allow tenant takeover.
- PIM roles whose activation needs no MFA or approval.
- Over-privileged apps and service principals.
- Sync accounts and cross-boundary paths that start in AD and end at Global Administrator.
Why your existing stack misses this
Identity attacks don't look like attacks.
EDR / XDR
No malware, nothing to detect.
SIEM
Alerts fire after Tier-0 is already gone.
PAM
Attack paths don't require vaulted credentials.
Monitoring-only tools
Good diagrams, no prevention.
See your environment like an attacker
Deep path and permission mapping
Every path and every hop, with no assumptions.
Fix what matters
A clear remediation order based on real blast radius.
Measure risk reduction
Watch Tier-0 exposure drop as paths disappear.
How Netra compares
| Capability | BloodHound | Defender | Tenable | Semperis | Netra |
|---|---|---|---|---|---|
| Identity attack path analysis | Strong (graph) | Log-based | Yes | Direct / state | Strong (Tier-0 specific) |
| Focus on chained paths | Broad | No | Broad | Direct only | Core focus |
| Tier-0-centric modeling | Generalized | Partial | Generalized | Yes | Primary design goal |
| Continuous analysis | Enterprise | Yes | Yes | Yes | On-demand scans, no always-on sensors |
| Preventive remediation | No | No | No | Yes (rollback) | Path elimination |
| Actionable hardening guidance | Generic | High-level | Generic | Recovery-focused | Precise and prioritized |
| AD + Entra ID depth | Improving | Monitoring | Yes | Yes | Identity-native |
| Embedded local AI | No | No | No | No | NetraBot via Ollama |
Comparison as published on netrasecsol.com. Competitor capabilities change; check current vendor documentation.
NetraBot: forensic AI that runs inside your network
NetraBot is a local AI analyst powered by Ollama, embedded in the Netra appliance. Every question, explanation and remediation it generates is handled by a local model, so your identity data stays inside your network.
Air-gapped AI
Runs Mistral, LLaMA or Phi-3 locally through Ollama.
Forensic intelligence
Explains any finding in plain English, including MITRE ATT&CK techniques, DCSync, Golden SAML and shadow-admin chaining, and writes board-ready summaries.
Works offline
No internet dependency. If the Ollama engine is paused, a recovery guide appears inline.
Read-only, local, and easy to feed into your SOC
Least privilege
AD Explorer uses standard LDAP queries; a normal domain user can find most paths. Entra Explorer needs a Global Reader or Security Reader role and never requests write or delete permissions.
Stays on your machine
Scan results stay in memory or in local JSON and HTML reports. Findings are never sent to us or pooled with other customers.
SIEM export
Findings export as JSON for Microsoft Sentinel, Splunk and Elastic. Webhook export goes only over HTTPS to destinations your administrator lists in advance.
Signed licences
Licences are RS256-signed and verified on the machine. Trials cover one AD domain or OU, or one Entra ID tenant.
The hybrid bridge
On-premise lens and cloud lens
- Recursive ACL mapping, Tier-0 perimeter audit and Kerberos attack discovery in Active Directory.
- Graph API over-privilege audit, PIM elevation analytics and app-role over-privilege in Entra ID.
Where they meet
- Map paths that start in AD and escalate to Global Admin in Entra ID.
- Sync account forensics, cross-boundary pathing and federated identity audit.
Try Netra with your own data
See the sample demo first, then tell us about your environment. We agree the scope with you before anything is installed.