Assume breach.
Then prove what an intruder reaches next.
NodeX extends the same adversary inside your perimeter from a hardened, outbound-only node. It proves lateral movement, privilege escalation, and Active Directory and Entra ID abuse with real exploits.
The perimeter is not the end of the story
Most testing stops at the edge. Attackers do not. Once inside, they move east-west, abuse trust in Active Directory and Entra ID, and escalate until they own the domain. You rarely know how far that reach goes until it is too late.
SpartanX does not treat the inside as a separate exercise. The same adversary that proves an external foothold carries the path inward, chaining a reachable entry point through an exposed credential into a full internal escalation. One continuous campaign, edge to domain admin.
How it works
Deploy NodeX
NodeX runs from a hardened, outbound-only node, with images for AWS and GCP plus an OVA, so the adversary operates inside without opening a new way in.
Assume breach
Starting from an internal foothold, SpartanX maps internal networks, machine identities, and segmentation into the environment graph (OKEG).
Move and escalate
The adversary performs lateral movement, abuses Active Directory and Entra ID trust, and escalates privilege, probing internal APIs and east-west paths.
Prove the path
Each step is validated with a working exploit and scored by business impact (PESS), so you see exactly how an intruder reaches crown-jewel systems.
What you get
Proven blast radius
Segmentation that holds
AD and Entra ID clarity
Stop guessing how far an attacker moves once they are already inside your network.
Prove your blast radius
Deploy NodeX and see exactly where an assumed breach leads.