- 40,000+
- users in defense, aerospace, healthcare and energy
- Since 2008
- writing logon software that runs inside the Windows security kernel
- Black Hat USA
- where we presented DCShadow in 2018, with Benjamin Delpy
- NATO supplier
- listed in the NCAGE database under FB4V9
Our strategy
Smart cards are the fix everyone recommends. Few get them deployed.
Contractors sharing one password on critical infrastructure. Administrator credentials harvested from a workstation cache. A hardware keylogger behind a desk.
Microsoft and government frameworks give the same answer to all three: certificate logon with a smart card. Then the project meets trust chains, card drivers and directory integration, and adoption stays far behind the threat.
Our software removes those obstacles one by one, and it starts from what you already own: PIV and CAC cards issued under HSPD-12, national eID cards, an existing PKI, or nothing more than a USB key. You keep your cards and your directory; we make Windows accept them.
Products
Start from the situation you are in
Two commercial products for logon, a break-glass key for Entra ID, and three free components to make a card work on Windows.
Not sure which one fits? Describe your environment and we will point you to the right one.
Research
We know Windows authentication from the inside
DCSync and DCShadow, the two Active Directory replication techniques of mimikatz, were written with Benjamin Delpy. Our products are built with the same knowledge of LSASS, Kerberos and the smart card stack.
We publish what we learn: 34 technical articles and how-to guides, from kernel-mode security packages to the error messages of a failed logon.
BlueHat IL 2018 · Black Hat USA 2018 · Romhack 2019 · FIRST 2024
All articles and services- Attack technique DCShadow: the rogue domain controller attack A workstation becomes a domain controller for a few seconds and pushes changes through replication, under the radar of the SIEM. How it works and how to detect it.
- Windows internals PKU2U: peer-to-peer authentication internals The Windows security package that authenticates two machines with certificates, message by message.
- Development notes Developing a kernel-mode security package Notes from writing a security package that runs both in LSASS and in the kernel.
- Field guide Troubleshooting smart card logon on Active Directory Each error message of a failed logon, with its cause and its fix: trust, revocation, certificate mapping.
Services
When the product you need does not exist yet
Card manufacturers and integrators ask us for the parts of Windows that few people write.
Smart card drivers
A minidriver, a CSP or an OpenSC driver at a fixed price, passing Microsoft's test suite and ready for distribution through Windows Update.
Windows authentication
Credential providers, SSP/AP and kernel security packages, NegoEx extensions, password filters: custom logon for any device or protocol.
Active Directory replication
Replicating credentials between forests that do not trust each other, or hardening a domain against DCSync and DCShadow.
Try it on your own machines
The trial is the full product for 30 days, with no credit card. EIDVirtual, the GIDS applet and the OpenPGP drivers are free.