ADscan 9.1.1

Added

• AD Exposure Score: a single 0-100% headline metric for how exposed a domain is to full compromise from a low-privilege foothold, with a separate "Proven" figure (validated, not estimated). It leads the executive summary, the executive PDF hero on page 2, the technical report JSON, and the web dashboard, where it also trends over time across scans.
• Sample teaser report: a new short (~6-page) report profile for cold outreach, with a cover, industry benchmark, executive summary, one headline attack path, a DORA snapshot, and a call to action.
• The SMB share phase now captures credentials from writable shares (planting a lure that harvests authentication material) alongside the existing readable-share credential hunt.

Changed

• PRO runs are now as fast as LITE. A packaging choice had made PRO 12-20x slower on large graphs; attack-path computation that previously took hundreds of seconds now finishes in tens.
• Attack paths that reach full domain compromise are now ranked above paths that only gain a foothold on a domain controller, so the top-listed path (and the one an unattended run executes) is the most impactful one.
• More domain-compromise routes are surfaced and correctly labeled: taking over a privileged user's logged-on session to run code as them or recover their credentials, constrained-delegation abuse, and admin access on a writable domain controller now chain through to "Domain Compromised".
• After the domain is compromised through an attack path, an audit run now re-collects the environment as the compromised admin and runs the credential-harvesting sweep automatically; previously this happened only when your starting account was already a Domain Admin. Redundant attack-path prompts after compromise were removed.
• Unattended (CI) audit runs are bounded on large estates: the readable-share credential hunt scans the top 25 highest-risk shares (logged; re-run interactively for all), and the heavy-artifact deep-analysis phase is skipped by default.
• The SMB share phase was renamed from "Share Credential Hunt" to "SMB Share Exposure".
• Before planting a share lure, ADscan asks for confirmation first and performs no folder enumeration if you decline (audit defaults to no, CTF defaults to yes).

Fixed

• On rootless Docker and Podman, ADscan no longer fails at startup with a cryptic "Operation not permitted". It starts in a reduced-network mode and shows a clear panel covering what works, what is degraded, and how to restore full features.
• Very large SMB collections that could hang for many hours are fixed (a resource leak triggered by unreachable or dropped hosts).
• Credential replication against a bare account name such as administrator or krbtgt in a multi-domain forest now targets the correct domain instead of returning no data.
• Share access reporting no longer over-reports read-only shares as writable. Shares like NETLOGON and SYSVOL now show the effective access your account actually has, not the raw share grant.

Removed

• The separate ADCS discovery step was removed from the scan flow; certificate-services detection is now handled earlier in the graph collection, so the scan runs one fewer redundant step.