It gives clear, continuous visibility into Active Directory and Entra ID risk without installing agents on domain controllers. The Indicators of Exposure come with plain explanations and concrete remediation steps, which makes it easy to hand findings straight to AD admins. The Indicators of Attack add real-time detection of things like DCSync and Kerberoasting, and it fits well alongside the rest of the Tenable platform. Review collected by and hosted on G2.com.
License consumption can grow quickly in large environments, and there is no way to temporarily pause or disable a connected domain. Disconnecting means deleting the whole configuration (domain, forest, and relay) and provisioning it again later, which makes managing license usage more cumbersome than it should be. Review collected by and hosted on G2.com.