DOMAINator is a fully automated Active Directory penetration testing platform. You connect a VPN to a client's network, enter the target IP, and the system executes a real attack chain — credential harvesting, relay attacks, privilege escalation, and lateral movement. It tests every known escalation path, not just the first one it finds. You get a full penetration test report with evidence, attack paths, and remediation — not a vulnerability scan.

DOMAINator runs before your pentester arrives on-site. It maps the entire Active Directory, tests every escalation path systematically, and delivers a full report with proven exploits — all in minutes. When your pentester starts, they already have the domain map, every credential, every attack chain laid out. They spend their time validating and expanding instead of discovering from scratch. It's the recon phase on steroids — giving your team a head start that turns a 5-day engagement into a focused, high-impact assessment.

AI scanners suggest theoretical vulnerabilities. They don't exploit anything. They can't relay a credential, escalate privileges, or move laterally through an Active Directory environment. DOMAINator performs real exploitation with real tools — it harvests actual credentials, gains real shells, and achieves actual Domain Admin access. The report shows proof, not predictions.

A traditional retest checks only the findings that were reported. DOMAINator's rescan runs the entire attack chain again from scratch. It re-tests everything — including new attack paths that appeared since the fixes, regressions, and misconfigurations the original scan didn't need because it already had DA. Your pentester gets a fresh full report showing what's fixed, what's not, and what's new — without spending another week on-site.

Your data never leaves the scan environment. Credentials and hashes found during the scan are used only within the attack chain and kept only inside your report. The report stays available for a limited time based on your plan (24 hours, or 48 hours on Emperor and CISO), then the report and the sensitive scan contents are permanently deleted — only a non-sensitive summary is kept for your history. We don't share data with third parties. Zero data is sent to any AI service.

Yes, absolutely. DOMAINator executes real attacks against real infrastructure. You must have written authorization from the network owner before running any scan. Every scan requires you to confirm authorization. Unauthorized use is illegal and a violation of our terms of service.

Three things: 1) An account on DOMAINator. 2) A VPN configuration file (.ovpn) that connects to the target network. 3) The IP address of a Domain Controller. Upload the VPN, enter the target, and hit scan. The platform handles everything else — from reconnaissance to the final report.

Most scans complete in 8–10 minutes depending on the environment. You can watch the entire attack chain live in real-time through the terminal view. Every action is logged and visible — nothing happens behind a black box.

The CISO plans (Warband and Legion) are built for security teams. You get a command dashboard to manage multiple pentesters, monitor all scans across your team, view aggregate analytics, and control scan policies. Each team member gets their own credentials — they run scans, you see everything.

Yes. All plans are month-to-month unless you choose annual billing (which saves 17%). Cancel anytime — no contracts, no hidden fees, no cancellation penalties. Your account and any remaining scan credits stay active until the end of your billing period. (Individual reports still follow their normal access window — 24 hours, or 48 hours on Emperor and CISO — after which they are deleted.)