MFA, access policy and session control for every login your IdP can't see.
MFA, conditional access, just-in-time privileges and session recording for Active Directory, Linux, databases and network gear. Your existing AD, live in an afternoon.
Verify every login. Decide every request. Control every session.
One platform does all three, on the systems you already run.
MFA on every login
Logins wait at the domain controller until the user approves, using the MFA app they already have.
j.doe → srv-fin-01 · held · approved · signed in
See MFAThe right check for every request
Allow, ask for MFA, or block based on who, where, and when. Start in audit mode, enforce when ready.
admin · from home · 21:00 → MFA required
See access policyEvery admin session recorded
Admin sessions go through the gateway, never straight to the server, and every session is recorded.
j.doe → prod-web-02 · recorded · 3m 12s
One control plane for every privileged login.
Your directory and MFA app go in. AuthNull verifies, decides and controls. A small component at each system enforces it, and every decision is logged.
Click a system to trace its path
- One policy for every loginThe same rules across AD, Linux, databases and network.
- No standing accessPrivileges granted just in time, then removed.
- Nothing on workstationsComponents sit on DCs, a gateway and database hosts only.
- Every decision loggedOne audit trail, sent to your SIEM.
One platform across the systems you already run.
- SystemAD & WindowsComponentDC SensorCoversKerberos · NTLM · RDPJobsVerify · Decide · ControlProtect AD & Windows
- SystemLinux & SSHComponentSSH gatewayCoversSSH · sudoJobsVerify · Decide · ControlProtect Linux & SSH
- SystemDatabasesComponentDB agentCoversPostgreSQL · MySQL · SQL ServerJobsVerify · Decide · ControlProtect databases
- SystemNetworkComponentRADIUS BridgeCoversRADIUS · TACACS+JobsVerify · DecideProtect your network
Live without locking anyone out.
Roll out one path at a time, starting in audit mode.
- Step 01: Install
Add the component for each path
DC Sensor for AD, SSH gateway for Linux, DB agent for databases, RADIUS Bridge for the network.
DC Sensor · SSH gateway · DB agent · RADIUS Bridge
- Step 02: Audit
Watch before you enforce
Policies run in audit mode first, so you see who would be challenged without blocking anyone.
- Step 03: Enforce
Turn it on when you’re ready
Switch a policy to enforce. Every decision is logged from day one.
A platform, not another layer.
Most teams stitch together an MFA tool and a PAM tool. AuthNull does both jobs in one platform.
MFA layer vs full platform
They do: MFA and access policy on AD logins.
AuthNull adds: session recording, just-in-time access, and a password vault in the same product.
Where they’re stronger: identity threat detection and cloud identity.
ComparePer-seat vs flat pricing
They do: the authenticator app and MFA for apps.
AuthNull adds: MFA held at the domain controller, plus PAM. It works with Duo, so you keep your app.
Where they’re stronger: the authenticator itself.
ComparePAM without the programme
They do: enterprise PAM, sold per module.
AuthNull adds: session management, just-in-time access, and vaulting, live in days, with MFA on everyday logins included.
Where they’re stronger: Windows privilege elevation and application secrets.
| Capability | AuthNull | Silverfort | Duo | CyberArk |
|---|---|---|---|---|
| MFA on AD logins | ✓ | ✓ | ✓ | Separate product |
| Access policy | ✓ | ✓ | ✓ | ✓ |
| Session recording | ✓ | Separate product | Separate product | ✓ |
| Just-in-time access | ✓ | Separate product | Separate product | ✓ |
| Password vault & rotation | ✓ | Separate product | Separate product | ✓ |
Coverage based on public product information.
Self-hosted or SaaS. Flat pricing. A free month to try it.
Everything stays on your infrastructure.
Works with the MFA you already use: AuthNull Authenticator, Duo, or Okta. See supported factors