Meridian Bank
corp.meridian.local
Assessment 14
Production
Auto up to T2
Demo data
SI
Exposure overview
37 attack paths reach Tier 0. Three choke points sit on 31 of them, and four fixes are already rated safe to apply.
Paths to Tier 0
37
22 validated · 15 inferred
Credentials found
48
11 privileged · secrets redacted
Awaiting approval
2
Oldest waiting 5 hours
Closed this month
18
Each with a closure record
Coverage gaps
3
1 server without logon auditing
Safe fixes ready
4
Rated Safe by Shadow Impact Analysis
Live assessment
Meridian Bank · corp.meridian.local
Scan runningDemo02:41:17
DiscoveryGraph collectionExploitation 64%Fix planning
Latest activityChecking effective permissions on OU Tier0-Admins214 hosts · 4 domain controllers
Validated paths · weakness → business impact
Every ribbon is an executed, proven chain — not an inferred one. Click an impact for the proof and the 1-click safe fix.
Weakness
Tier 0 impact
Awaiting approval
ESC1 · WebServer-LegacyAD CS · Certipy · Tier C
Kerberoast · svc_backupRC4 TGS · Impacket · Tier B
GenericAll · IT-HELPDESKChoke point · bloodyAD · Tier C
Unconstrained · WKS-0142Delegation · NetExec · Tier B
Shadow Creds · ENTRACON01$KeyCredentialLink · Tier C
NTLM relay → LDAPSTier D · awaiting approval
Exposure score
CriticalProjected after the top 3 safe fixes: 34 (modelled, not proof)
Permissions88
Certificates (AD CS)79
Kerberos and delegation64
Credentials and hygiene71
Top choke points
Ranked by paths cut. Fix safety comes from Shadow Impact Analysis.
18 of 37
ValidatedT3 reverted
9 of 37
ValidatedT4 test account
4 of 37
InferredT1 graph
3 of 37
TestedT2