Package
Know where to act before changing critical access
A read-only Active Directory audit, followed by a prioritised findings meeting and an awareness workshop. The package helps you understand the visible risks, then decide what to do next without working blind.
For organisations whose authentication relies on Active Directory
This package is for small and medium-sized businesses that want an objective view of the state of their access, and to give their teams concrete landmarks against phishing and social engineering. It is not a penetration test, an ISO 27001 or NIS2 certification, or full compliance.
The starting price shown above covers a directory of one domain with up to 50 accounts and a workshop for up to 8 participants. Findings are delivered within one to two weeks (estimated calendar time).
What leaves access in the dark, and what brings it back into view
Active Directory, the foundation nobody really looks at
It concentrates identities, rights and much of the organisation's authentication. Yet it is one of the least audited components, because it is technical and invisible day to day. As long as everyone can log in each morning, nobody asks who can actually do what.
Forgotten accounts, excess rights, reflexes to rebuild
Under the stable surface lie accounts of former staff that were never disabled, privileges granted for the duration of a project, and delegations nobody can justify any more. And when a well-imitated email arrives, your teams become the last line of defence, not always with the right reflexes.
A report to decide on, and better prepared teams
The audit is read-only and changes nothing: each finding is placed at its level of risk and turned into an action priority, in a report that non-technical management can read. The awareness workshop deals with the other half of the subject, the human factor, so that technology and reflexes move forward together.
How it works
Prepare: the domains, accounts and domain controllers concerned are identified, so the analysis covers the agreed scope.
Observe: the audit is read-only and covers configuration, delegations, GPOs and privileged accounts. It is not a penetration test.
Report: the report, the risk score and the management summary separate critical, high, medium and low issues.
Build reflexes: the awareness workshop, adapted to your context, covers phishing, passwords, social engineering and what to do with a suspicious message.
For organisations outside France, the audit is carried out remotely with read-only access, and the findings meeting and workshop take place by video call, in English or French. An on-site workshop is possible on quote.
Two services in one package
Technology and people are handled in the same movement: understand the sensitive points, then recognise risky situations better day to day.
Active Directory audit: a non-intrusive analysis of your directory and a prioritised report readable by non-technical management.
Awareness training: an interactive session with role play, a quiz and a debrief of areas for improvement.
What is included
Read-only Active Directory audit, for one domain and up to 50 accounts.
Detailed report with a risk score.
Tailored awareness workshop.
Prioritised remediation plan.
A detailed remediation quote if needed.
Findings meeting and concrete recommendations.
What the package does not cover
Penetration testing, continuous monitoring, on-call duty or incident handling.
Any change to Active Directory during the audit.
Remediation of the points found, which is quoted and approved separately.
Certification or any guarantee of compliance with ISO 27001, NIS2 or GDPR.
Any guarantee that no vulnerability or incident will occur in future.
Further reading
From €4,200 per project
All prices are invoiced in euros.
Frequently asked questions
Does the audit change Active Directory?
No. The audit is read-only. Any remediation is sized after the findings meeting and only starts once you have approved it.
Does the package suit every directory?
The starting price covers one domain and up to 50 accounts. Between 51 and 200 accounts the price is adjusted; multi-domain, complex or larger environments are quoted.
Does the awareness training guarantee fewer incidents?
No. It aims to build better reflexes through examples, role play and a quiz. It does not guarantee future behaviour or a measurable reduction in incidents.
What happens after the findings meeting?
You have a prioritised report and, if needed, a detailed remediation quote. That step is optional, separate from the audit and sized on the points actually found.