See what an attacker would find. Before they do.
Vela gives your own team an everyday view of the weaknesses a penetration tester looks for, explained in plain language, with the fix and a playbook for every one.
Your team sees what an attacker would find.
Vela checks Active Directory, AD CS and Entra ID for the weaknesses a penetration tester looks for, and explains each one in plain language: what’s wrong, why it matters, exactly which accounts and objects are affected, and how to fix it.
- Every finding rated by what it lets an attacker do
- The users, groups, templates and policies involved, named
- A fix you can follow, and a way to prove it worked
Certificate template ‘WebServer-Legacy’ lets any user choose who they are
Fix
- In the template’s properties, open Subject Name.
- Choose “Build from this Active Directory information” instead of “Supply in the request”.
- Limit enrolment to the accounts that genuinely need it.
Verify
certutil -dstemplate WebServer-Legacy msPKI-Certificate-Name-Flag
# the flag no longer contains 0x1
Detect & monitor
Service-ticket requests are logged as event 4769 on domain controllers. A request that downgrades to RC4 for a non-machine account is the strongest single signal.
SecurityEvent | where EventID == 4769 | where TicketEncryptionType == "0x17" | where ServiceName !endswith "$" | summarize Count=count(), Accounts=make_set(TargetUserName) by bin(TimeGenerated, 1h), IpAddress | where Count > 5 or array_length(Accounts) > 3
Every finding comes with a playbook. Your team gets sharper every time.
Each playbook is written by a working penetration tester. It explains how the attack really works, how to confirm it in your own environment, what to watch for in your logs, and how to fix and verify it. It’s training that turns up exactly when it’s relevant.
- See an issue the way a penetration tester does
- Windows event IDs and ready-made hunting queries for Microsoft Sentinel and Defender
- Mapped to MITRE ATT&CK, with references for going deeper
A pen test is a photo. Vela is the live feed.
Your estate changes every day: new admins, relaxed policies, a quick fix that never got undone. Vela keeps checking on the schedule you set and tells you what changed, where, and why it matters. Your next pen test starts from a cleaner estate and spends its time on the hard problems.
- 14:02ADj.smith added to Domain Admins
- 13:47Entra ID“Require MFA” policy set to report-only
- 11:20AD CSA template now lets requesters supply the subject
- 09:15Entra IDNew app granted access to every mailbox
- 08:02ADUnconstrained delegation enabled on SRV-APP-04
- 07:40Entra ID14 stale guest accounts removed
Close the issues, and show the progress.
Fixes ready to follow
Clear steps for every finding, commands ready to run, and a check that confirms the fix worked.
Progress you can report
See what’s open, fixed and new over time. Reports map findings to CIS Controls v8 and MITRE ATT&CK, the frameworks your managers and auditors already know.
Alerts where you work
Send what matters to email, Microsoft Teams, Slack or your SIEM, so nothing waits for someone to open a dashboard.
Your directory data stays with you.
Vela runs inside your network with read-only access to your directory. It changes nothing, and what it finds stays on your own server.
Identity first, checked against how attackers actually work.
Active Directory
- Kerberoastable and AS-REP roastable accounts
- Risky delegation
- LAPS gaps and stale admin passwords
AD CS
- ESC1–ESC8, ESC11 and ESC13
- Weak enrolment permissions
- Web enrolment relay
Entra ID
- Conditional Access and legacy sign-in gaps
- Risky app consent
- Privileged role sprawl
Microsoft 365, Azure & AWS
- The same approach, extended to mail, cloud subscriptions and accounts
Vela is made by IJH Labs, whose founder spent fifteen years leading identity and cloud assessments. Every check started as a finding in a real client report.
Find out what’s already wrong with your estate.
See Vela on your own environment in a 30-minute call, or join early access.