GOAD benchmarks

Same starting conditions

AutoAttack restored the vanilla GOAD snapshot before each test. Both products ran from the same address and subnet, with access to all five hosts and no supplied credentials. AutoAttack used standalone mode. This was one test per tool on 24 June 2026.

Nessus configuration

The Advanced template used thorough tests, paranoid plugin accuracy, all 65,535 TCP ports and every plugin family. Safe checks remained on. This was one tested configuration.

Access route

1. ~0:30

   Two Kerberos authentication responses (AS-REP) were cracked offline: brandon.stark in NORTH and missandei in ESSOS. Kerberos pre-authentication was disabled.

2. 0:41

   The recovered missandei account had administrative access on meereen. Directory replication returned the ESSOS krbtgt key and the trust key shared with SEVENKINGDOMS.

3. 0:42

   A forged Kerberos ticket with additional security identifiers crossed the forest trust. Replication against kingslanding returned the SEVENKINGDOMS Administrator account.

4. 0:45

   Forest-root access enabled directory replication of the child domain through winterfell, confirming NORTH Domain Admin.

A tilde (~) marks an approximate time in the original write-up. These are access milestones, measured from the start of the AutoAttack run.

Complete campaign output

AutoAttack's full campaign took 2m 37s. Its log lists 85 findings and 327 actions across five reached hosts, with 124 credentials recovered and three Domain Admins confirmed.

Nessus completed its scan in 24m 04s, with no confirmed compromise and no recovered credentials. It reported 0 critical, 22 high, 94 medium, 5 low and 692 informational items. The 22 high-severity items covered SWEET32 on 20 services, one SMBv1 flag and one MS17-010 flag. Neither test exploited MS17-010; it remained a reported exposure requiring validation.

This Nessus report did not contain AutoAttack's credential-and-trust route. The research also reports a separate Nessus scan supplied with Domain Admin credentials for all three domains. It took 28m 48s and returned 158 critical, 353 high, 127 medium, 7 low and 1,506 informational items. Those starting conditions differ from this comparison.

Ten independent AutoAttack runs

Hardened GOAD used Windows Server 2016/2019 patched through March 2026, with Defender on, LLMNR disabled and provisioning accounts disabled. Each run began after a clean VM rollback, without supplied credentials or prior environment knowledge, and had a three-minute execution window.

Access route

All ten runs followed the same route. Initial credentials came from a Kerberos authentication response (AS-REP), a directory description queried through LDAP and a script in the domain's shared SYSVOL folder in approximately ten seconds. Local administrator access on castelblack enabled retrieval of stored account secrets (LSA secrets) through remote registry at approximately 30 seconds. The NORTH sql_svc password also worked for ESSOS sql_svc, which held Domain Admin privileges.

Directory replication on meereen confirmed ESSOS Domain Admin at a median 0:41. A forged Kerberos ticket with additional security identifiers enabled the forest-trust step to kingslanding, confirming SEVENKINGDOMS at median 0:45. Forest-root access then enabled replication of NORTH through winterfell at median 0:51. These are access milestones, not full run durations.

The separately published NodeZero result

Horizon3 tested an AWS deployment patched at the time of its August 2025 experiment. Its timeline places the final domain compromise at 13:45 and the final host at 14:25. This comparison uses the domain milestone. The ratio between the domain times is about 16×. These were separate experiments with different infrastructure, patch dates and software versions.