BloodHound
Graph-based attack path mapping for Active Directory and Entra ID, for red and blue teams.
About
BloodHound uses graph theory to reveal hidden, often unintended relationships inside Active Directory and Microsoft Entra ID. It treats users, groups, computers, and other principals as nodes and permissions and relationships as edges, then calculates the shortest path from a compromised account to a high-value target such as a domain administrator. Attackers use it to find complex attack paths; defenders use it to identify and eliminate those same paths. It has become a standard tool on both sides, to the point that Microsoft documents its presence as a high-fidelity indicator of malicious reconnaissance when found outside an authorized audit.
There are two editions. BloodHound Community Edition is free and open source (Apache 2.0, 3,492 GitHub stars at last check), aimed at penetration testers and red teams, with data collection via the SharpHound ingestor and visualization on a Neo4j graph database. BloodHound Enterprise is SpecterOps' fully managed SaaS for blue teams focused on attack path management: continuous collection, exposure measurement, choke-point prioritization, and practical remediation guidance. In 2026 SpecterOps extended the platform across hybrid environments and added BloodHound Hunter, which connects approved AI agents to BloodHound findings over MCP.
What it can do
- Graph-theory attack path discovery
- Active Directory and Entra ID support (CE); AWS, Okta, GitHub, Jamf via OpenGraph (Enterprise)
- Choke-point analysis and prioritization
- SharpHound data collectors
- Practical remediation guidance (Enterprise)
- BloodHound Hunter: AI-agent access to findings over MCP
- MITRE-agnostic privilege relationship mapping
Setup
- Community Edition: deploy BloodHound CE via the quickstart Docker setup and run the SharpHound ingestor against your domain.
- Explore attack paths in the graph UI; prioritize chokepoints that sever the most paths.
- Enterprise: request a demo at bloodhoundenterprise.io for the managed SaaS with continuous collection and remediation guidance.
Prerequisites
A Windows/AD or Entra ID environment you are authorized to assess; credentials with read access to directory data.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (TIER verified, metrics-v1). Evidence: 3,492 GitHub stars (checked 2026-10-16); Apache 2.0; active development; the industry-standard tool for AD attack path analysis, recognized by Microsoft and embedded in Cortex XSOAR workflows; commercial Enterprise edition funds the project. Strengths: unmatched graph-based privilege analysis, trusted on both red and blue teams, strong recent AI and hybrid-cloud investment. Docked for: (1) the dual-use nature means defenders must scope its use carefully in their own environments; (2) CE lacks the continuous collection and remediation guidance that make the Enterprise edition operationally valuable. License: Apache 2.0 (Community Edition); proprietary (Enterprise).
★ 3,492 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 8.0/10
- Maintenance · recency, releases, issue load
- 8.0/10
- Openness · license + docs
- 10.0/10
- Manual review · sanity read + red-flag check
- 1.0/10
- · 3,492 GitHub stars checked 2026-10-16; active development
- · Industry-standard AD/Entra ID attack path analysis; recognized by Microsoft
- · BloodHound Hunter adds MCP-based AI agent access in 2026
- · Dual-use tool; CE lacks Enterprise continuous collection
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.