Semperis describes itself as an identity-driven cyber resilience and crisis management company. Its products protect directory services, with coverage for Active Directory, Entra ID and Okta. The company is headquartered in Hoboken, New Jersey, has research and development teams in the United States, Canada and Israel, and is led by CEO Mickey Bresman. Semperis groups its products into an Identity Resilience Platform that covers threat prevention, detection and response, disaster recovery for directories and identity providers, migration, and cyber crisis management. Semperis states that its platform helps organisations protect their identity fabric before, during and after a cyberattack. This overview explains how the platform works and what it covers, based on Semperis’s public product information and announcements.
At A Glance
| Vendor | Semperis, headquartered in Hoboken, New Jersey |
|---|---|
| Category | Identity threat detection and response, directory backup and recovery, cyber crisis management |
| Identity systems covered | On-premises and hybrid Active Directory, Entra ID and Okta |
| Deployment | Lightning Intelligence is offered as SaaS; Ready1 runs as a secure cloud platform |
| Community tools | Purple Knight and Forest Druid |
| Market classification | Identity Threat Detection & Response; also Directory & Identity Infrastructure |
What The Platform Does
Semperis describes its Identity Resilience Platform as providing defence in depth for Active Directory, Entra ID and Okta. The main products are set out below.
Directory Services Protector
Semperis describes Directory Services Protector (DSP) as an Active Directory and Entra ID threat prevention, detection and response platform. According to Semperis, it can detect AD attacks at the replication stream that bypass event or log-based monitoring, and it uses multiple data sources, including the Active Directory replication stream. Semperis states that DSP provides real-time threat notifications across Active Directory and Entra ID for SOC teams, can automatically roll back malicious changes in AD and Azure AD, and lets administrators search, correlate and undo Active Directory changes at the object and attribute level.
Lightning Platform
Semperis describes the Lightning platform as covering agentic and conventional attack prevention, detection and response.
| Lightning Identity Runtime Protection (IRP) | Announced as the first offering in the Lightning platform. Semperis states that it uses machine learning models developed by identity security experts to detect widespread and successful attack patterns, using directory change tracking data across hybrid Active Directory and Entra ID environments. |
|---|---|
| Lightning Intelligence | Announced on 4 December 2024. Semperis states that it tracks security posture across multi-forest Active Directory and multi-tenant Entra ID environments, using security indicators developed by its security research team. |
Active Directory Forest Recovery
Active Directory Forest Recovery (ADFR) is described by Semperis as cyber-first disaster recovery for Active Directory. Semperis states that it automates the recovery process, including cleaning up metadata, restructuring site topology and rebuilding the Global Catalog, and it supports multi-forest recovery. ADFR decouples Active Directory from the underlying operating system, which Semperis says prevents malware reinfection, and it allows organisations to restore to their most recent backup even if domain controllers were infected when backups were taken. Semperis states that recovery can target any hardware, virtual or physical, and that the cloud can be used as a disaster recovery site. ADFR can also create a replica of the production AD environment for recovery drills. Semperis reports that ADFR can reduce the time to recover AD after a cyberattack by up to 90%.
Disaster Recovery For Entra Tenant And Recovery For Okta
Semperis describes Disaster Recovery for Entra Tenant as backup and recovery for Entra ID resources, noting that some Entra ID objects exist only in the cloud. Recovery for Okta provides full and incremental backups of identity provider tenants. Semperis states that it supports rollback of individual aspects of the environment or of the whole environment to a backup, restores single attributes, and helps identify suspicious activity and revert unwanted changes. It supports both same-IDP and cross-IDP scenarios.
Migration And Delegation
Semperis lists Migrator for AD for security-first Active Directory migration and consolidation, and Delegation Manager for AD for securing Active Directory permissions.
Ready1
Ready1 is described as an enterprise cyber crisis response platform. Semperis states that it consolidates crisis management, incident response, downtime planning and communication tools, and provides expert playbooks, real-time incident logging and auditing, and response teams built around skills, availability and incident severity. Communications include secure mobile notifications, incident-based chat and third-party incident response activation, and Semperis states that the platform is designed to work even when other systems fail.
Assessment Tools
Semperis publishes two community tools.
| Purple Knight | Described as a free AD, Entra ID and Okta security assessment tool, built and managed by Semperis’s threat research team, that discovers indicators of exposure and indicators of compromise. |
|---|---|
| Forest Druid | Described as a Tier 0 attack path discovery tool for Active Directory and Entra ID, focused on attack paths leading into the Tier 0 perimeter in hybrid identity environments. |
Integrations
| Area | Documented integrations |
|---|---|
| Directory and identity systems | On-premises Active Directory, hybrid AD, Entra ID and Okta |
| Data sources | Active Directory replication stream and directory change tracking data |
| Recovery targets | Virtual or physical hardware, and the cloud as a recovery site |
| Identity providers | Same-IDP and cross-IDP recovery for Okta tenants |
| Microsoft ecosystem | Microsoft partner and member of the Microsoft Intelligent Security Association |
Use Cases And Industries
Semperis publishes material on detecting and responding to attacks on Active Directory and Entra ID, rolling back malicious directory changes, recovering Active Directory forests after ransomware, backing up and restoring Entra ID and Okta tenants, migrating and consolidating Active Directory, and coordinating cyber crisis response. The company states that it has been trusted by large enterprises and government agencies for more than a decade. Semperis also hosts the Hybrid Identity Protection conference and podcast.
This overview is compiled from Semperis’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.