BloodHound
See your enterprise like an attacker
About BloodHound
BloodHound by SpecterOps maps identity attack paths across Active Directory, Entra ID, and other identity platforms using graph analysis, showing how chained permissions lead to critical assets. The free, open-source Community Edition is a staple for penetration testers and red teams, while BloodHound Enterprise is a commercial SaaS platform that continuously monitors attack paths, prioritizes choke points, and guides remediation.
Pros & Cons
Pros
- Community Edition is free, open source, and the de facto standard for Active Directory attack path discovery in red teaming
- Graph view makes chained permission abuse obvious in ways flat audit reports miss
- Enterprise prioritizes choke points so a small number of fixes removes large numbers of attack paths
- Covers hybrid identity: Active Directory, Entra ID, and OpenGraph extensions for AWS, Okta, and GitHub
- Backed by SpecterOps research and recommended by CISA and MITRE for attack path discovery
- Large practitioner community with active Slack and shared training material
Cons
- Enterprise pricing starts at a $77,250 annual minimum, which puts it out of reach for small organizations
- Community Edition requires manual setup and data collection and is built for point-in-time assessments, not continuous monitoring
- Steep learning curve; graph analysis and Cypher queries assume Active Directory security knowledge
- Few public reviews on G2 and similar sites to benchmark the Enterprise product
Key Features
Attack path graph
Applies graph theory to identity relationships, permissions, and trusts to reveal the paths an attacker can take from a standard user to domain admin or other critical assets.
Hybrid identity coverage
Analyzes Active Directory and Entra ID (Azure AD), with Enterprise-supported OpenGraph extensions for AWS, Okta, GitHub, and Jamf-managed Macs.
Choke point prioritization
Enterprise identifies the few configuration changes that sever the most attack paths; SpecterOps reports an average of 17,000+ paths cut per choke point.
Privilege Zones
Define multiple privilege tiers around business-critical applications, regulated systems, and sensitive groups, then visualize and fix zone violations.
BloodHound OpenGraph
Extends the attack path graph beyond Active Directory to cloud, SaaS, and developer environments through a library of community and enterprise extensions.
Abusable configuration detection
Detects abusable conditions across ADCS, NTLM relay exposure, Azure PIM roles, ACLs, Kerberoastable accounts, and more.
Remediation guidance
Enterprise provides prioritized, tested remediation steps aligned to business risk, with ownership and SLA tracking for each attack path.
Security stack integrations
Adds attack path context to SIEM alerts and incident response workflows so teams know which alerts matter most.
BloodHound Hunter
A read-only agent interface in Enterprise that brings BloodHound graph intelligence into your approved AI agents for investigation and prioritization.
Community Edition
Free, Apache-2.0 open-source edition with containerized deployment, a REST API, and native support on Kali Linux for time-bound assessments.
Pricing
- Open source (Apache 2.0)
- Attack path discovery for Active Directory and Entra ID
- OpenGraph extensions
- Self-hosted, manual setup and data collection
- Community support via Slack
- Starting at $30.90 per employee with a $77,250 annual minimum (AWS Marketplace list price)
- Volume discounts at higher tiers
- Continuous, automated attack path monitoring
- Choke point prioritization and remediation guidance
- Privilege Zones add-on available
- Dedicated TAM and enterprise support
- BloodHound Enterprise plus SpecterOps expert services
- Tailored attack path remediation guidance
- Advanced analysis for emerging threats
- Privilege Zone design and OpenGraph support
Best For
Red team and penetration testing
Testers use Community Edition to find the fastest, quietest path from a compromised user to domain admin during engagements.
Continuous identity attack path management
Security and identity teams use Enterprise to monitor attack paths over time and track measurable risk reduction.
Active Directory hardening
Find excessive ACL rights, Kerberoastable privileged accounts, and ADCS misconfigurations, then fix the highest-impact choke points first.
Hybrid and cloud identity security
Trace how on-premises AD, Entra ID, Okta, and AWS identities chain together across environment boundaries.
Least-privilege enforcement
Use Privilege Zones to segment access around critical assets and detect identities that violate tier boundaries.
Similar Tools
Tuta
Secure email with quantum-resistant encryption
Odoo
Modular open-source ERP for manufacturing & beyond
Google Fonts
Free, open-source web fonts for modern design and development
Concrete CMS
The free, open source CMS for teams who need powerful content control
Continue
The open-source AI coding assistant for VS Code and JetBrains
Elgg
A powerful open source social networking engine