Maester — 4 tests in the core
MT.1011, MT.1024, MT.1107-1109 and MT.1191. They run today in every tenant that uses Maester, not only in mine.
Attack-surface intelligence, in the open
See what an attacker can already access.
Type your domain. We read only its public signals (DNS, TLS, HTTP, Certificate Transparency) and return a scored, explainable external posture. No install, no signup, nothing stored.
$ vantage scan <your-domain>
Public data only.
Bought Pro? Paste the access token from your receipt email to unlock the full report. Nothing shown for free is ever fabricated.
Who does this
I am Eduard Arbona. I build security tooling for Microsoft 365 and Entra ID identity, and I publish it in the open so you can read how it works before you trust me with a tenant.
Eighteen tools are published at github.com/earbona23. Every one is read only, none has external dependencies, and all of them run on synthetic data so you can try them without connecting anything of yours. They include the ones I use on every review: a real privilege inventory of a tenant, the blast radius of a compromised account, and the minimum set of actions that provably severs it.
I work alone. That means you talk to the person doing the work, with no account managers and no handoffs. It also means I do not sell 24/7 coverage I cannot staff. What I offer is deliberately narrow.
ArrankaGo Consulting is a division of ArrankaGo LLC, Delaware, USA.
The security suite
Five focused, read-only tools, each runnable right here on a real sample.
I did not just run these. I wrote parts of them.
Four of the tests Maester runs against your tenant are mine. So is the CISA SCuBA Entra ID baseline in Prowler. Every claim below is a pull request you can open.
Microsoft Sentinel — analytic rule shipped
Detection for an end user consenting to an app that asks for mailbox access together with offline_access. It reaches tenants through the Content Hub.
Prowler — CISA SCuBA baseline for Entra ID
The US CISA Secure Cloud Business Applications baseline for Entra ID, contributed as compliance content. Open upstream, not merged yet.
Microsoft Graph PowerShell — import fix
Non-ASCII source characters broke module import on Windows PowerShell 5.1. Root-caused and fixed, with a regression guard.
PowerShell Gallery — installable in one line
entra-tripwire ships on the PowerShell Gallery: Install-Module EntraTripwire. Deception-based Entra ID detection you can install and run against your own tenant in minutes.
The baselines themselves belong to their authors: SCuBA to CISA, the Foundations Benchmark to CIS, EIDSCA to its maintainers, ORCA and Entra ID to Microsoft, and Maester to the Maester community. They are open source and anyone can run them. What is harder to find is someone who has had code merged into them.
Services
The self-serve tools above are the tip. Where the work needs authorized access and judgment, we run it as a fixed-scope engagement.
Microsoft 365 and Entra ID identity exposure review
Fixed scope, read only access, authorized in writing and revocable by you at any time.
Most reviews hand you a list. This one answers the question that comes next: if this account gets phished, how far does the attacker reach, and what do I have to cut so they do not?
What I review:
- Who actually holds privilege today: permanent versus eligible admins, admin accounts with no usable second factor, roles that were granted and never removed.
- Conditional access gaps, including the policies that fail open.
- Third party app consents, with a focus on the illicit consent grant pattern.
- Configuration drift: the Intune changes that weakened your posture with nobody watching.
- The blast radius of every privileged identity, and the minimum set of actions that provably severs a compromised one from what matters.
What this is not: not a penetration test. I do not exploit anything, I do not write to your tenant, and I never need a user's credentials. If you need active testing, that is a separate service under its own written authorization.
How the access works:
- Read only. The review reads directory roles, Conditional Access, app consents, audit logs and device configuration, and writes nothing to your tenant. The Microsoft Graph scopes are all read scopes: Directory.Read.All, RoleManagement.Read.Directory, Policy.Read.All, Application.Read.All, AuditLog.Read.All and DeviceManagementConfiguration.Read.All.
- You grant it with your own admin consent, in your own session. I never receive, see or store your credentials.
- Authorized in writing before anything runs, scoped to the engagement, and revocable by you at any moment: remove the consent and the access ends immediately.
- The findings are yours. What is kept and for how long is set in that written scope, and everything is deleted on request.
You get a report with prioritized findings and concrete remediation, plus a session to walk your team through it.
Start with a paid diagnostic: a US$250 call where I read your external exposure and tell you straight whether the full assessment is worth it for you — no tenant access at this step. Commission the assessment within 30 days and the US$250 is credited in full.
From US$6,500, fixed scope.
Before you hire me, read a report I already wrote. It is a real report, generated by my own tools over a synthetic-data tenant. It does not ask for your email.
Domain exposure
Real breach and stealer-log intelligence, now free (source: XposedOrNot).
Tip: enter a domain, or a work email for a richer per-account breach view (free email analysis via XposedOrNot).
Threat intelligence report
Run a domain against every configured intelligence source. Each source is a card: finding, clean, or (honestly) not evaluable.
Passive recon only, public data and third-party intel databases. We never scan the target host.
Check a domain in the Exposure section above to build its full threat & exposure report here.
Sources we read:
DNS
crt.sh
XposedOrNot
urlscan.io
Have I Been Pwned
Shodan
VirusTotal
AlienVault OTX
GreyNoise
abuse.ch / URLhaus
● public · ● needs a key (honest "connect" state until set)
Pricing
Per organisation, per month. Annual billing = two months free. The demos and one live scan are free.
External posture, measured and certified
We scan what your domains already show any visitor: DNS, TLS, HTTP headers, cookies, email authentication and Certificate Transparency. Nothing else. We do not exploit anything, we do not port-scan, we do not test passwords, and we need no access to anything of yours.
You get a score where every point comes from a rule you can read, with findings split into three states: there is something to fix, it was measured and passes, or we could not evaluate it. What we could not measure is said out loud, never counted as passing.
- Free scan: the score, the breakdown by severity and the first complete findings. No signup, nothing to install, and we do not store the result.
- Full report: every finding with its remediation, the complete discovered surface, machine-readable output, a malware/C2 indicator (IOC) match, dependency and secret exposure across your public GitHub repos, public storage-bucket exposure checks, and continuous monitoring.
How we work
The whole product runs on one rule: only real, public, verifiable data. Here is exactly what that means.
Public signals only
We read DNS, TLS, HTTP headers and Certificate Transparency, the same things any visitor can. We do not exploit, port-scan, brute-force, or use proprietary feeds.
Every finding is traceable
Each point in a score maps to a rule you can read. Each external claim names its source (HIBP, Shodan, VirusTotal, OTX, GreyNoise, abuse.ch) and links back to it.
Three states, never two
finding, clean, and not-evaluable. What we could not measure is labelled, never silently counted as "clean". A missing API key says "connect this source", never a fake number.
Nothing is invented
Not a breach, not a CVE, not a count, not a testimonial. If a source returns zero, we show zero. The teaser number is always the real one, inflating it to sell would be fraud.
What we will never do
- Show a fabricated breach count to pressure a purchase.
- Claim a certification (SOC 2, ISO, "Gartner-rated") we do not hold.
- Upload your files or credentials. Sensitive-input tools run on samples.
- Invent a customer, a logo, or a number to look bigger than we are.