Crown jewels.

Name what you cannot lose. See everything that can reach it.

The finance database, the domain controllers, the backup server, the certificate authority. MagenX works backwards from each one, and the answer is assembled from every layer at once - because no single layer can answer it alone.

SQL-FIN-01 finance database · tier 0 adjacent FIREWALL 3 source zones one is the guest VLAN ACTIVE DIRECTORY 14 accounts +4 that can reset them NETWORK 2 neighbours unsupported, trusted CLOUD IDENTITY 1 hybrid role skips MFA on a gap
  1. Firewall · FortiGate

    3 source zones can open a session to it, one of them the guest VLAN through a rule written broadly in 2019.

  2. Active Directory

    14 accounts can log on to it, and 4 more can reset the accounts that can.

  3. Network

    2 unsupported hosts share its subnet and the firewall treats them as trusted neighbours.

  4. Cloud identity

    1 hybrid account holds a cloud role that maps back to it and skips MFA on a conditional access gap.

The answer is one sentence per jewel: how many distinct routes reach it, the shortest one, and the single change that removes the most of them at once. For SQL-FIN-01 that change is a firewall rule, not a directory fix - which is exactly the sort of thing a directory audit cannot tell you.