Detect live Active Directory attacks in air-gapped networks without cloud telemetry

Executive Summary

Large enterprises and mid-market organizations that run on-prem Active Directory—roughly 120,000 potential customers—still struggle to detect live AD attacks when environments are air-gapped or cloud telemetry is prohibited, leaving SOC teams and auditors with dangerous visibility gaps. With identity-first attacks rising, these blind spots enable credential theft, lateral movement, and persistence to go unnoticed until major breach events occur. You could build a fully on-prem detection product: an appliance and agent suite that analyzes AD logs, network artifacts, and endpoint indicators locally with a curated behavioral+signature engine and optional open-source components, delivering alerts, forensic captures, and SIEM integrations without ever sending telemetry to the cloud. Offerings could be priced around the $30K ACV point as a subscription or appliance, tailored for air-gapped deployments and SOC workflows. The market looks attractive now—an addressable market of about $3.6B driven by regulatory/contractual restrictions on cloud telemetry, growing AD attack volume, and increased enterprise acceptance of open-source security tools that favor on-prem solutions. This can stand out by combining deep AD-specific detection tuned for identity-first threats with a provably air-gapped architecture and transparent/open-source components that ease audits and procurement concerns; however, success requires solving hard engineering problems to minimize false positives, building trust through POCs with a few marquee customers, and differentiating from medium-level competition.