Assess. Score. Compare. Report.
Agentless security assessment whose report opens with what changed
Guerrilla is a free, open source, read-only PowerShell 7 security assessment platform for on-premises Active Directory, the Entra ID, Azure, Intune, and Microsoft 365 identity plane, and Google Workspace. It authenticates with the access you already grant it, reads configuration and directory state, and reports. It never installs an agent and never writes to the systems it assesses.
Why "Guerrilla"
Asymmetric defense for the outmatched
Guerrilla warfare is the doctrine of the outmatched: you don't win by matching a bigger force's resources, you win with asymmetric, low-cost, know-your-terrain tactics. That is who this tool is for. A school district or a small business with a decaying Active Directory faces the same certificate attacks, the same DCSync, the same OAuth abuse a Fortune 500 faces, with no security team and no six-figure tool budget.
Guerrilla is built for the organizations enterprise security tooling prices out: free, open source, agentless, runnable by one admin from one PowerShell prompt, on terrain they already know. The name isn't a theme. It's the mission statement.
Numbers from the gating run
Every number on this site derives from the test run that gates the release (module v2.48.0). Hard-coded stats fail the build.
Run comparison
Every run is compared against your last run
The report opens with What Changed Since Last Run: newly failing checks first, then anything that lost visibility, then confirmed remediations, with the score delta overall and per Zero Trust pillar, and the Not Assessed delta at equal prominence. A check that was assessed before and is Not Assessed now is never rendered as no change: a check going dark is exactly how revoked read access or a broken collector hides an attacker.
Run history is local and per-user: verdicts, evidence hashes, and scores. Never raw evidence values, no accounts, no telemetry, no network. A crashed or partial run is never recorded, so it can never poison the comparison baseline. Checks added by an upgrade are labeled NEW and checks removed are labeled RETIRED, never counted as changes.
Invoke-Campaign, the all-platforms run, answers what changed with the same single comparison mechanism as the per-platform audits.
Want the delta on a rhythm? Guerrilla ships no scheduler and does not run in the background. Task Scheduler or cron re-runs the same command, and the next report opens with what changed. Running Guerrilla on a cadence.
Scoring
The Guerrilla Score
A composite 0 to 100 score, described here exactly as the module computes it: Posture (70 percent, from findings across the three platforms), Coverage (15 percent, how many of the three platforms the run assessed), and Trend (15 percent, movement against your previous run). Six risk ratings from Low Risk to Critical Risk, each describing how far the configuration sits from the assessed baselines.
Platforms
Three platforms, one module
636 checks with severity ratings, current versus recommended values, remediation steps, framework mappings, and a fixture-proven verdict for every one.
Validation
Proven, not asserted
Every check's verdict logic is proven by golden fixtures: 1,829 synthetic tenant states driven through the real check functions, with the expected verdict written down in advance. The release gates emit the numbers this site renders, and the gates themselves must prove they can fail.
Get started
Install the module, run your first audit
Install from the PowerShell Gallery and run Show-Guerrilla to open the Operations Console: run scans, manage the credential Safehouse, browse reports, and tune settings. You configure Guerrilla locally, in the module, not through a web form.