Executive Assessment

Silverfort Identity Security Risk Assessment

Assess identity control exposure across hybrid directories, legacy MFA, privileged authentication and non-human identities. Receive an indicative exposure index and tailored next steps. No credentials or sensitive configuration details requested.

All AssessmentsRequest NDA

Answer from what you can support. Use Unknown / not assessed when you cannot judge a control. Choose a known gap only when you know the practice is absent or ineffective.

All questions must be answered. An overall score requires at least 80% known answers and at least 60% known answers in every section. The result describes this self-reported profile; it is not an audit, certification or probability of an incident.

Identity estate and visibility

Identity estate and visibility

1. How accurately are your Active Directory and Entra ID authentication paths mapped?
2. How are legacy authentication protocols and applications identified?
3. How complete is the inventory of privileged human identities?
4. Are directory trust relationships and changes governed?
MFA and authentication enforcement

MFA and authentication enforcement

5. Is MFA enforced for domain administrators across relevant authentication paths?
6. How are legacy applications without native MFA protected?
7. How consistently are vendor and contractor logins protected?
8. Are break-glass accounts safeguarded and recovery procedures tested?
Privileged and third-party access

Privileged and third-party access

9. How are standing administrative privileges limited?
10. Are privileged protocols covered by authentication-time controls?
11. How are third-party privileged accounts retired?
12. Can privileged logins be traced to accountable individuals?
Service accounts and non-human identities

Service accounts and non-human identities

13. Do you have an owned inventory of service accounts and machine identities?
14. Are service account privileges and interactive access restricted?
15. How are long-lived service credentials governed?
16. Can unusual service-account activity be investigated?
Identity threat detection and response

Identity threat detection and response

17. Can on-premises and cloud identity events be correlated?
18. How prepared is the team for password spraying and suspicious privileged logins?
19. Is there a tested playbook for privileged identity compromise?
20. When were identity controls last independently validated?