Report Comparison (Change Detection)

Report comparison lets you detect what changed between two audits of the same profile. This is essential for security monitoring — it answers the question “what permissions changed since the last time I checked?”

Report comparison is a Pro feature.

Running a Comparison

You can compare reports in two ways:

Manually from the home screen:

1. Select a profile that has at least two saved audits in its history
2. Select two reports from the audit history
3. Use the compare action

Automatically via scheduled tasks: When a scheduled task is configured in Change Detection mode, it runs a new audit and automatically compares it to the most recent saved audit for that profile. See Scheduled Tasks.

The comparison opens in a new tab. The application matches folders by path between the old and new reports and checks every permission entry for differences.

Change Types Detected

The comparison identifies the following types of changes:

Folder changes:

Change type	What it means
Folder New	A folder exists in the new audit that wasn’t in the previous one
Folder Deleted	A folder from the previous audit is missing in the new one
Folder Inheritance Changed	The inheritance setting changed (enabled → disabled or vice versa)
Folder Modified Changed	The folder’s last modified timestamp changed

Permission changes:

Change type	What it means
Permission Added	A new permission entry was added to a folder
Permission Deleted	A permission entry was removed from a folder
Permission Initial	A permission on a newly discovered folder (listed alongside Folder New)

Group membership changes:

Change type	What it means
Group Member Added	A user was added to a group that has permissions on a folder
Group Member Removed	A user was removed from a group that has permissions on a folder

Each change entry shows the folder path and a description of what changed, including the specific account names, permission levels, and scope.

NIS2 Critical Change Marking

When changes are detected, the application automatically evaluates whether each change is critical from a NIS2 compliance perspective. Changes are marked as [NIS2 CRITICAL] if they meet any of these criteria:

• Full Control permissions were added, removed, or modified
• Everyone, Authenticated Users, or ANONYMOUS LOGON access was changed
• The change affects a critical path — folders whose names contain keywords like finance, hr, admin, backup, security, confidential, or management
• External domain access was added (accounts from a different domain)
• Service account changes — accounts with names containing “svc_” or “service”

This marking helps you prioritize which changes require immediate investigation for compliance purposes.

Viewing the Change Report

The comparison results are displayed in a grid with columns for:

• Change type — The category of change (folder, permission, group member)
• Folder path — Where the change occurred
• Changes — A description of the specific change, including NIS2 critical markers

You can sort and filter the change report to focus on specific types of changes.

Exporting the Change Report

Change reports can be exported to the same formats as regular audit reports: Excel (XLSX), CSV, HTML, XML, and PDF. The export includes all detected changes with their types, paths, and descriptions.

When a scheduled task detects changes, the change report is automatically exported to the configured path and optionally emailed to the specified recipients.

No Changes Detected

If the comparison finds no differences between the two audits, a message confirms that no changes were found. For scheduled tasks with the “Email only if changes found” option enabled, no email is sent in this case.

Tips for Effective Change Detection

• Use consistent profiles — Always audit the same directories with the same settings. Changing the profile between audits produces misleading comparisons.
• Enable group member expansion — Without it, group membership changes won’t be detected.
• Schedule regular comparisons — Weekly or monthly automated comparisons with email alerts give you continuous visibility into permission drift without manual effort.
• Investigate NIS2 critical changes first — These represent the highest-risk modifications and should be reviewed promptly.