Semperis

Semperis is a private company founded in 2014, headquartered in Hoboken, New Jersey, with substantial engineering in Israel, and backed by a growth investment led by KKR in 2022. It sells two main products. Directory Services Protector monitors Active Directory, Entra ID and Okta for dangerous changes and misconfigurations, scores the environment against known attack techniques, and can automatically roll back specific changes. Active Directory Forest Recovery automates the rebuild of a compromised or destroyed AD forest to clean operating systems. The company also publishes two free tools that are widely used well beyond its customer base: Purple Knight, a security assessment for AD and Entra ID, and Forest Druid, which maps attack paths into Tier 0. The distinguishing capability is forest recovery, and it matters because of how bad the alternative is. Microsoft's documented forest recovery procedure is long, manual, and full of steps that are easy to get wrong under pressure, and restoring domain controllers from system-state backup restores the operating system too, which can reintroduce the malware you are recovering from. Semperis restores the directory itself onto clean instances, including different hardware or a cloud target, and can do it without the original operating system images. Directory Services Protector adds a detection layer with a genuinely useful property: it reads changes from the AD replication stream rather than only from domain controller security logs, so changes made directly against the directory database, which bypass logging, are still captured. The buyer is an organisation whose entire authentication estate hangs off on-premises Active Directory, which is still most large enterprises, and the purchase is usually triggered by a ransomware incident elsewhere in the sector, a cyber insurance question, or an auditor asking how long AD recovery would take when nobody can answer. The trade-offs are scope and rehearsal. It addresses one dependency, so its value falls in proportion to how much identity you have genuinely moved off AD, and the licence buys tooling rather than a tested runbook. A recovery plan that has never been executed end to end in a lab is an assumption with an invoice attached.