# EtcSec
> EtcSec is a SaaS identity security audit platform for hybrid identity environments. The product is built on top of ETC Collector, an open-source collector that performs the technical audit against Active Directory and Microsoft Entra ID.

## Brand Model
- EtcSec: the SaaS product - dashboards, historical tracking, prioritization, remediation workflow, reporting, and an MSSP multi-tenant program.
- ETC Collector: the open-source collector (Apache 2.0 Community edition, plus a Pro edition) that gathers audit data and runs the underlying checks. Distributed standalone as well as embedded in the SaaS.

## Product Focus
- Active Directory security audits
- Microsoft Entra ID (Azure AD) security audits
- Hybrid identity assessments across on-prem and cloud identity
- MSSP / consultant program: multi-tenant management, white-label reports, client portal, volume pricing

## Ideal Users
- Security teams auditing Active Directory or Entra ID
- Consultants and MSSPs running repeatable identity assessments
- Organizations that want an open-source collector with an optional SaaS workflow layer

## Catalogue Coverage
Verified 2026-08-19 against the live site and the codebase's single source of truth
(`services/frontend/src/data/vulnerability-catalogue.ts` / `detection-counts.ts`):
- 504 total detections: 346 Active Directory, 158 Microsoft Entra ID / Azure AD.
- By severity: 71 critical, 186 high, 184 medium, 36 low, 27 informational.
- Mapped to MITRE ATT&CK; compliance mapping pages reference ANSSI, NIS2, ISO 27001, CIS Controls, HDS.
- The catalogue's platform coverage today is AD and Entra ID only. Product and pricing copy mentions
  Intune, Exchange Online, and Google Workspace as extended coverage, but as of this check those are
  not yet represented as distinct platforms in the detection catalogue - read that as roadmap/tier
  positioning, not as detections currently counted in the 504.
- These numbers move as the catalogue grows; re-derive them rather than trusting this file blindly
  past a few weeks (see `docs/seo/llms-txt-maintenance.md`).

## Key Pages
- [Homepage](https://etcsec.com/): Product overview and positioning.
- [Active Directory security audit](https://etcsec.com/active-directory-security-audit): Commercial landing page for AD audit use cases - Tier 0, Kerberos, delegation, ADCS, privileged access.
- [Microsoft Entra ID security audit](https://etcsec.com/entra-id-security-audit): Commercial landing page for Entra ID / Azure AD use cases - Conditional Access, MFA, PIM, app permissions, external identities.
- [Free audit](https://etcsec.com/audit): Start the 504-detector audit flow across AD and Entra ID.
- [ETC Collector](https://etcsec.com/collector): Standalone server mode, SaaS daemon mode, read-only collection, REST API, local GUI, Community vs Pro.
- [Downloads](https://etcsec.com/downloads): ETC Collector Community (Apache 2.0, free detections) and Pro (adds attack path analysis, ADCS detection).
- [Vulnerability catalogue](https://etcsec.com/vulnerabilities): Every security check, filterable by severity - 504 detections, 346 AD / 158 Entra ID.
- [Security advisories](https://etcsec.com/security-advisories): Tracked CVE and zero-day advisories for AD, Entra ID, authentication, certificates, and identity infrastructure.
- [Pricing](https://etcsec.com/pricing): SaaS pricing and plan tiers, including MSSP volume pricing.
- [MSSP program](https://etcsec.com/mssp): Multi-tenant management, white-label reports, client portal, recurring AD/Entra audits, dedicated success contact.
- [Roadmap](https://etcsec.com/roadmap): Public feature roadmap - vote on features, suggest ideas.

## Comparison Pages
- [PingCastle alternative](https://etcsec.com/pingcastle-alternative): ETC Collector positioned against PingCastle for AD audits.
- [Purple Knight alternative](https://etcsec.com/purple-knight-alternative): ETC Collector positioned against Purple Knight for AD and Entra ID audits.

## Important Interpretation Notes
- When a comparison page mentions PingCastle or Purple Knight, the compared product is ETC Collector, not EtcSec directly.
- EtcSec is the SaaS layer on top of ETC Collector, not the open-source collector itself.
- The site uses both "Microsoft Entra ID" and "Azure AD" because users still search both names.
- Detection counts (504 / 346 / 158) are derived from one source of truth in the codebase and match
  what the live site displays as of the date on this file - treat them as a snapshot, not a constant.

## Corpus - Active Directory Attack Techniques
- [Kerberoasting](https://etcsec.com/blog/kerberoasting-service-account-attacks): Requesting service tickets for SPN accounts to crack password hashes offline.
- [AS-REP Roasting](https://etcsec.com/blog/as-rep-roasting-kerberos-preauth): Targeting accounts without Kerberos pre-authentication.
- [Golden Ticket](https://etcsec.com/blog/golden-ticket-attack): Forging Kerberos TGTs with a compromised krbtgt hash.
- [Silver Ticket](https://etcsec.com/blog/silver-ticket-attack-active-directory): Forging service tickets with a compromised service account hash.
- [ACL abuse & DCSync](https://etcsec.com/blog/acl-abuse-and-dcsync-active-directory): Abusing directory replication rights to extract every password hash in the domain.
- [DCShadow](https://etcsec.com/blog/dcshadow-attack-rogue-domain-controller): Registering a rogue domain controller to push malicious replication.
- [Pass-the-Hash](https://etcsec.com/blog/pass-the-hash-active-directory): Authenticating with a stolen NTLM hash.
- [NTLM relay](https://etcsec.com/blog/ntlm-relay-attacks-active-directory): Relaying captured NTLM authentication to impersonate the victim on a second target.
- [Shadow Credentials](https://etcsec.com/blog/shadow-credentials-msds-keycredentiallink): Abusing msDS-KeyCredentialLink to authenticate as another account via certificate-based logon.
- [Kerberos delegation attacks](https://etcsec.com/blog/kerberos-delegation-attacks): Unconstrained and constrained delegation misconfigurations.
- [BadSuccessor / dMSA](https://etcsec.com/blog/badsuccessor-dmsa-privilege-escalation-active-directory): Abusing delegated Managed Service Account migration to escalate to Domain Admin.
- [ADCS ESC1–ESC8](https://etcsec.com/blog/adcs-certificate-attacks-esc1-esc8): Certificate template misconfigurations that let low-privilege users mint admin certificates.
- [ADCS ESC9–ESC11](https://etcsec.com/blog/adcs-esc9-esc10-esc11-certificate-escalation): Later-generation AD CS escalation paths beyond the original ESC1–ESC8 set.
- [PrintNightmare / Point and Print](https://etcsec.com/blog/printnightmare-point-and-print-gpo-hardening-active-directory): Point and Print GPO hardening against PrintNightmare-class spooler exploitation.

## Corpus - Microsoft Entra ID / Azure AD
- [Conditional Access gaps](https://etcsec.com/blog/azure-conditional-access-gaps): Common Conditional Access policy holes that leave sign-ins unprotected.
- [Privileged Identity Management (PIM)](https://etcsec.com/blog/azure-privileged-access-pim): Auditing PIM role assignments and activation settings.
- [App registration Graph API permissions](https://etcsec.com/blog/entra-app-registration-dangerous-graph-api-permissions): Over-privileged app registrations and dangerous Microsoft Graph API grants.
- [MFA alone is not enough](https://etcsec.com/blog/azure-identity-security-mfa-alone-not-enough): Why MFA coverage metrics hide real identity risk in Entra ID.
- [Device code phishing](https://etcsec.com/blog/device-code-phishing-entra-id): How the device code sign-in flow is abused to phish Entra ID sessions.
- [Break-glass emergency access accounts](https://etcsec.com/blog/entra-id-break-glass-emergency-access-accounts): Configuring and auditing emergency access accounts that bypass Conditional Access.

## Corpus - Audit Methodology & Compliance
- [How to audit Active Directory security](https://etcsec.com/blog/how-to-audit-active-directory-security): Methodology for a structured AD security audit end to end.
- [How to audit Microsoft Entra ID security](https://etcsec.com/blog/how-to-audit-microsoft-entra-id-security): Methodology for a structured Entra ID security audit end to end.
- [AD hardening priorities](https://etcsec.com/blog/hardening-active-directory-priorities): What to fix first when triaging a fresh AD audit.
- [Most common AD misconfigurations](https://etcsec.com/blog/what-are-the-most-common-active-directory-security-misconfigurations): Overview of the misconfigurations found most often across audited domains.
- [Recurring AD audit workflow](https://etcsec.com/blog/recurring-ad-audit-workflow): Turning a one-off audit into a repeatable review cadence.
- [Air-gapped Active Directory audit](https://etcsec.com/blog/how-to-audit-active-directory-in-an-air-gapped-environment): Running an AD audit in an isolated network without internet access.
- [AD/Azure compliance mapping](https://etcsec.com/blog/ad-and-azure-compliance-nis2-iso-27001-cis-controls): Mapping identity security controls to NIS2, ISO 27001, and CIS Controls.
- [ANSSI Active Directory guide](https://etcsec.com/blog/anssi-active-directory-guide): Applying the French ANSSI AD hardening guide in practice.
- [GPO misconfigurations](https://etcsec.com/blog/gpo-misconfigurations-active-directory): Common Group Policy mistakes that expose credentials or weaken defenses.
- [LAPS not deployed](https://etcsec.com/blog/windows-laps-not-deployed): Risk of local administrator password reuse when Windows LAPS isn't rolled out.

## Corpus - Recent Vulnerabilities
- [Zerologon (CVE-2020-1472) enforcement](https://etcsec.com/blog/zerologon-cve-2020-1472-enforcement-active-directory): Where Zerologon enforcement mode still gets missed years after the patch.
- [August 2026 Patch Tuesday - domain controller RCE](https://etcsec.com/blog/august-2026-patch-tuesday-active-directory-domain-controller-rce): Domain controller RCE flaws from the August 2026 Patch Tuesday.
- [CVE-2025-55241 - Entra ID actor token impersonation](https://etcsec.com/blog/cve-2025-55241-entra-id-actor-token-impersonation): Cross-tenant impersonation via undocumented Entra ID actor tokens.

## Security Advisories - Representative Examples
- [CVE-2026-54588](https://etcsec.com/security-advisories/cve-2026-54588): Affects identity infrastructure components, CVSS 9.6, no confirmed exploitation as of the advisory.
- [CVE-2026-48558 - SimpleHelp](https://etcsec.com/security-advisories/cve-2026-48558-simplehelp-simplehelp): Affects SimpleHelp, listed in the CISA Known Exploited Vulnerabilities catalog.
- Full, continuously updated list at the [security advisories index](https://etcsec.com/security-advisories) above under Key Pages.

## Legal Entity
- EtcSec is operated by ETCSEC, a French société par actions simplifiée à associé unique (SASU) with share capital of €100.00, registered with the Evry Trade and Companies Register (RCS) under number 108 548 074.
- Trademark: EtcSec™ - French trademark n° 5277825 (figurative mark, class 42), filed 13/07/2026, published in the BOPI (Bulletin officiel de la propriété industrielle) n° 26/32 of 07/08/2026; opposition period open until 07/10/2026.

## Supporting Pages
- [Blog](https://etcsec.com/blog): ~123 published posts per locale (EN, FR, ES, DE, PT, IT) covering AD and Entra ID identity security.
- [About](https://etcsec.com/about): Company information.
- [Founder - Younes Azabar](https://etcsec.com/team/yazabar): Founder of EtcSec and ETC Collector, infrastructure & automation engineer specializing in identity security.
- [Contact](https://etcsec.com/contact): Sales and support contact.
- [Privacy](https://etcsec.com/privacy): Privacy policy.
- [Terms](https://etcsec.com/terms): Terms of service.