Pick an attack pattern drawn from public advisories. Switch on the identity controls you have today. See how far the attacker would get, and which step your controls stop.
What the result means. This is a tabletop model, not a scan. It does not connect to your environment or collect any data. The result assumes every control you switch on is configured, enforced and monitored. Testing whether that is true in your environment is what an assessment does.
From first access to moving laterally, per the CrowdStrike 2026 Global Threat Report. Identity controls have to work faster than that.
Want to know whether these controls hold up in your environment? Book a free 30-minute call with an engineer.