What PING CASTLE does

PingCastle (legal entity: Ping Castle SAS) is a French cybersecurity software company headquartered in Paris that builds tooling and services for Active Directory and Entra ID security assessment. The company's core product is a downloadable Windows executable built on .NET Framework 2.0+ that performs point-in-time security assessments of AD environments across four risk categories — Privileged Accounts, Trusts, Stale Objects, and Security Anomalies — using a proprietary rule-based scoring engine with 100+ rules mapped to ANSSI and MITRE ATT&CK frameworks. A maturity-based methodology wraps the technology to address process and people, not only configuration. The product is delivered in four integrated modules: Healthcheck (the default risk report), Map (AD cartography across trusts), Reporting (executive PowerPoint dashboards), and Enterprise (a higher governance tier with 24/7 monitoring capabilities). Most checks run without domain admin rights, lowering operational friction for assessors.

The business model is freemium-first: the binary is freely downloadable for any organization to audit its own systems, but commercial licensing is required to embed the tool in commercial packages or services. Paid revenue comes from quote-based one-time/perpetual commercial licenses, annual subscription-based support and maintenance contracts, and the higher-margin PingCastle Enterprise tier. The company originated in 2018 from a two-year, 300+ domain Active Directory security program at French utility ENGIE, led by founder and CTO Vincent Le Toux, and grew to usage by tens of thousands of enterprise and mid-market organizations globally. Named enterprise references include ENGIE, SUEZ, and Casino Group. On August 1, 2024, PingCastle was acquired by Netwrix (Frisco, Texas), with Vincent Le Toux remaining as CTO to lead integration. Post-acquisition, distribution moved to the Netwrix website, the GitHub repository moved to the Netwrix organization, and PingCastle is positioned as the discovery and assessment layer within Netwrix's broader continuous AD monitoring and identity threat detection portfolio.

Name

PING CASTLE

Legal name

Ping Castle SAS

Website

https://pingcastle.com

Company type

Private

Operating status

Operating

Short description

PingCastle builds Active Directory and Entra ID security assessment software for IT operations, IT management, and CISOs at enterprise and mid-market organizations, using a freemium binary, quote-based commercial licensing, and a maturity-based risk methodology.

Ownership category

akta.pro rank

Headquarters

HQ city

Paris

HQ country

France

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations

Revenue model

1. Free Community Edition: The binary program can be run for free as long as users do not derive revenue from it. Any for-profit organization can use it to audit their own systems at no cost. This drives adoption and network effects in the enterprise security community.
2. Commercial Licensing: A specific license must be purchased to include PingCastle in a commercial package or service. Pricing is quote-based through backend.pingcastle.com/Purchase. All outstanding quotes are honored through their expiration date.
3. Subscription/Maintenance: Annual subscription-based support and maintenance contracts available for commercial customers. Renewal managers reach out ~90 days prior to renewal dates. Legacy version support requires active subscription.
4. Enterprise Services: PingCastle Enterprise offering provides more robust governance processes for organizations requiring enterprise-grade support, continuous 24/7 AD monitoring, and integration with Netwrix's broader security portfolio.

Pricing tiers

Go-to-market motion4 records

Distribution channels4 records

Marketing channels4 records

Core offering

PingCastle develops software and services for Active Directory and Entra ID security assessment and risk reporting. Its core tool rapidly evaluates AD environments across privileged accounts, trusts, stale objects, and security anomalies, generating actionable risk scores, remediation guidance, and executive dashboards. It is offered as a free downloadable community binary for internal auditing and through commercial licensing, subscription support, and the PingCastle Enterprise tier for organizations embedding it in products or requiring enterprise-grade governance.

Product overview

PingCastle is a single unified product (Active Directory security assessment tool) that includes several integrated modules: Healthcheck (the default security analysis and risk evaluation), Map (Active Directory cartography for trust visualization), Reporting (management dashboard for KPIs), and Enterprise (enhanced governance tier). The tool operates on a maturity-based methodology to evaluate security levels, discover vulnerabilities, and provide actionable remediation guidance for IT Operations and IT Management teams.

Differentiator

Problem solved

Functional benefit

Products and services

• PingCastle Active Directory security assessment tool that identifies security vulnerabilities, evaluates security levels using a maturity-based methodology, and provides remediation insights across privileged accounts, trusts, stale objects, and security anomalies. Available as a free community binary for internal auditing, with commercial licensing required for embedding in products or services.
• PingCastle Enterprise Enterprise tier offering providing more robust governance processes, continuous 24/7 AD monitoring, and integration with Netwrix's broader end-to-end identity security portfolio for organizations requiring enterprise-grade support and reporting.

Quantifiable outcome

• 80% Active Directory security coverage achieved in 20% of typical assessment time
• +2 more outcomes

Named customers3 records

Segments5 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature5 records

Partnerships

One partnership is on record.

• NetwrixcoreStrategic or Co-development Partner · 1 August 2024Netwrix acquired PingCastle on August 1, 2024. The acquisition combines PingCastle's AD discovery and assessment capabilities with Netwrix's end-to-end solution for continuous 24/7 AD monitoring, change tracking, real-time identity threat detection, and recovery. Vincent Le Toux continues to manage PingCastle and help integrate it into Netwrix.

Scale indicators4 records

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• Microsoft Defender for Identity: Microsoft Defender for Identity is a first-party AD/identity threat detection product bundled into the Microsoft 365 security stack, offering continuous monitoring that increasingly overlaps with PingCastle's AD assessment surface.
• Qualys: Qualys is a broader cloud security and vulnerability management platform that includes identity and AD configuration assessment, competing with PingCastle as part of an enterprise-wide security suite.
• CrowdStrike Falcon: CrowdStrike Falcon is an endpoint and identity protection platform that includes identity threat detection and AD attack-path analytics, addressing a portion of PingCastle's risk-prioritization use case for enterprise SOCs.
• Tenable (Tenable Identity Exposure / formerly Alsid): Tenable acquired Alsid to add AD/Entra ID exposure assessment to its broader vulnerability management platform, competing with PingCastle as part of a much larger exposure management portfolio.
• Netwrix (parent company portfolio): Netwrix, PingCastle's parent since August 2024, offers AD change auditing and identity threat detection that complements and partially overlaps PingCastle's assessment tooling for the same enterprise customer base.

Emerging players

• BeyondTrust: BeyondTrust provides privileged access management and AD/identity security controls, addressing the privileged-account risk domain that PingCastle scores and reports on, with overlap in enterprise identity governance.
• Saviynt: Saviynt is an identity governance and cloud entitlement management platform that includes AD hygiene and risk scoring, comparable to PingCastle for enterprise identity posture and compliance use cases.

Others

• Swimlane: Swimlane is a security orchestration and automation platform that can consume PingCastle-style AD assessment outputs to drive remediation workflows, making it an ecosystem/adjacent rather than direct competitor.

Direct peers

• SpecterOps (BloodHound Enterprise): SpecterOps's BloodHound Enterprise maps Active Directory attack paths and quantifies identity-related risk, overlapping directly with PingCastle's AD cartography and privileged account/stale object risk scoring use cases.
• SempertiS / Semperis: SempertiS/Semperis specializes in Active Directory and Entra ID security, offering assessment, attack path analysis, and disaster recovery for AD — directly competing with PingCastle's AD assessment and risk-modeling capabilities in the same enterprise identity security category.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/netwrix
• GitHubgithub.com/netwrix/pingcastle
• LinkedInlinkedin.com/in/vincentletoux

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about PING CASTLE