Attack simulation.

From a chosen user, computer or group to your crown jewels, edge by edge.

Pick a starting point: a workstation, a service account, a contractor's laptop. MagenX follows the rights, memberships and delegations in your own directory and draws the routes that resolve, with the shortest one from each starting point.

STEP 1 STEP 2 STEP 3 STEP 4 TARGET denied by policy 118 when the path is checked against the firewall no route to Tier 0 nothing privileged is reachable FOOTHOLD one workstation SERVER the workstation's account can write to it CHOKE POINT one stale delegation PRIVILEGED TOKEN via SID History CROWN JEWELS the asset you named CUT HERE AND THE WHOLE ROUTE STOPS RESOLVING route that resolves branch that dead-ends the single edge to cut
Branches that cannot resolve are dropped. What survives shows the shortest route from each starting point, and the choke points ranked by how many routes each one cuts.

Derived, never tested

The graph is computed from what MagenX read in Active Directory. No exploitation, no credentials replayed, nothing fired at the live estate. A simulation you can run on a Tuesday afternoon.

Checked against the firewall

A weak account only matters if something can reach it. Any route can be checked against the firewall: each step that crosses the network is answered by the FortiGate rule that matches the packet, not by a subnet guess.

Cut one edge

Choke points are ranked by how many routes each one cuts. Remove that one membership or that one delegation, and every route through it stops resolving.