AI Pulse · Under the Radar

A new Claude Code plugin is packaging Active Directory security testing into a repeatable workflow. Rather than treating penetration testing as a collection of isolated tools, Claude-AD sets out the order of testing phases and the expected telemetry footprint for each technique. It then uses Claude Code skills and agents to coordinate tools including BloodHound, impacket, certipy and netexec.

That matters because Active Directory is still central to how many companies manage users, devices and access. A weak configuration, overly broad permission or exposed certificate path can turn a small access issue into a much larger one. The plugin’s focus is not just on running tests. It also maps findings to DORA, NIS2 and ENS compliance frameworks, which could make the output more useful for security leaders, risk teams and auditors who need to understand what a technical finding means in business terms.

The project had 96 GitHub stars and was gaining roughly 47 stars a day just two days after creation, so it’s clearly attracting early attention. That is not proof it works well in every environment, but it signals demand for AI-assisted security workflows that produce structured evidence rather than a pile of tool output.

For operators, the practical takeaway is simple. Security testing is moving toward guided, documented processes that can connect technical exposure to compliance obligations. This is the kind of thing we build into an AI command centre, where important signals, actions and risk context need to sit together.