Ransomware is what happens
after Domain Admin.
Human-operated ransomware doesn’t spread on its own. An attacker works from a foothold to Domain Admin, and only then disables the backups and pushes the encryptor to every host at once. AutoAttack is an autonomous adversary you deploy as one container inside your network: set the objective a ransomware crew would pursue, and it proves whether that path is open. It deploys no encryptor and changes nothing. It runs the same way every time.
Deployhow ransomware spreads
initial access An attacker turns one weakness into a foothold: a phished credential, an exposed service, a reused password. One host, no special privilege yet.
escalation They gain higher privilege on that first host, then hunt it for credentials that reach further.
lateral movement Credentials taken from one machine open the next. The attacker moves host to host, toward the accounts that run the domain.
domain control The chain ends at Domain Admin: control of a domain controller, and with it every host, account, and policy in the domain.
mass encryption Only now does the attacker disable the backups, switch off security tooling, and push the encryptor to every host at once, often through the domain’s own management channels.
what the adversary proves
objective Name the outcome a ransomware crew wants: reach Domain Admin, reach the backup server. You set it in plain English, and the adversary works toward it.
the route It returns the exact route to that goal: the weakness it started from, what it chained next, and where the path crosses into the domain (the same chain walked in Active Directory takeover).
the hosts Every host on that route, named: the machines an attacker would move through to reach the whole estate.
the backups Point it at the systems that hold your backups, and it proves whether they’re reachable from an ordinary foothold, the access an attacker needs before encryption pays off.
proof Every step carries the captured evidence behind it. You see what the adversary did, streamed to your dashboard as it lands. Verify it yourself.
the clock Crews break out in minutes and reach Active Directory in hours (CrowdStrike Global Threat Report; Sophos Active Adversary Report). AutoAttack runs the same race on your own network, on demand — and hands you the path it took to your objective. Before a crew runs it for real.
readiness vs a checklist
the question Vulnerability management returns a ranked list of weaknesses, each one matched to a database and never tried. Readiness asks whether an attacker can reach domain-wide control from where they’d land.
benchmark See the full chain.
safe on production
no encryptor It proves the path a ransomware crew would take and deploys no encryptor. Nothing on your network is encrypted or damaged.
no lockouts Credential attempts are throttled to your domain’s lockout policy. No account gets locked out.
no footprint It installs nothing and writes nothing to disk on your hosts. Proof streams to your dashboard as each step lands.
ephemeral Each engagement runs in a fresh container that lives only for the run, then is destroyed. Stop it from your dashboard the moment you choose. See how it stays safe.