03

Password audits

We test your organisation's passwords the way an attacker would after a hash leak — and show which policies work and which exist only on paper.

  • Active Directory
  • NTDS / hashcat
  • breach databases

Scope

  • Cracking Active Directory hashes
  • Shared and reused passwords
  • Presence in public breaches
  • Compliance with the password policy
  • Privileged and service accounts

What you get

  • Statistics without revealing passwords
  • List of accounts that need a change
  • Password policy recommendations
  • Material for staff training

What a password audit is

A comprehensive assessment of credential security in your organisation. We focus on the weak points of passwords: low complexity, reuse and presence in breach databases. It is an essential service for organisations managing large numbers of accounts, where both efficiency and security matter.

Our own hardware, full confidentiality

We run audits with our own tooling and dedicated cracking rigs built on Nvidia RTX graphics cards. Dedicated hardware gives performance, cost efficiency and full confidentiality — no cloud involved. We work on hashes, not plaintext, and the report contains statistics and account identifiers, never recovered passwords.

What you gain

  • Better IT security — identifying weak and compromised passwords removes easy targets for cybercriminals.
  • Better access management — we find unused accounts and tidy up access to systems.
  • An effective password policy — rules that enforce strong, unique passwords and raise resilience to attacks.
  • More aware employees — knowledge about password security changes daily habits.
  • Regulatory compliance — readiness for standards and regulations such as NIS2 and GDPR.
  • Cost optimisation — fast identification of threats instead of costly incidents.

How to strengthen password protection

  • An effective password policy — consistent, secure standards across the company.
  • Security level assessment — whether the passwords in use are strong enough and attack-resistant.
  • Removing weak points — dictionary, leaked and low-complexity passwords.
  • Eliminating reuse — accounts that share the same credentials.

Report and re-audit

The report includes an executive summary, a description of the methodology and attacks performed, and detailed results: patterns found, statistics of cracked passwords and recommendations for the security policy. Regular audits let you measure progress and react to a changing environment.

Testimonials

What our clients say

1 / 3
  • Working with Unshade guarantees professionalism and the highest standards. The team's flexibility, discretion and commitment were outstanding. I highly recommend Unshade as a reliable partner.

    Marcin MarczewskiCEO, Resilia
Blog

Read on the blog

All posts

CrackMeIFYouCan 2022 DEFCON Writeup

What's that? CrackMeIfYouCan on DEFCON is one of the most popular hash cracking contests in the wild. Best teams in the world compete on a 48h challenge to crack as many hashes as…

Read
Sample report

Request an anonymised report

See what our penetration test report looks like: the structure, findings with PoC, CVSS ratings and recommendations. We send an anonymised version to your work email.

  • Executive summary
  • Findings with proof of exploitation
  • CVSS risk ratings
  • Step-by-step remediation guidance

The form is being set up. Write to us directly: contact@unshade.pl