SpecterOps BloodHound: From Open-Source to Enterprise

BloodHound started as an open-source project to give security professionals new visibility into the hidden attack paths inside Active Directory and Azure environments. It is a trusted resource for penetration testers and researchers around the world. BloodHound Enterprise expands and transforms those insights into a powerful platform for defenders to continuously reduce identity risk at the source, preventing attacks, and protecting critical assets.

Learn More

Built for different missions

BloodHound Enterprise vs. BloodHound Community Edition

Take a closer look at BloodHound Enterprise

BloodHound Enterprise helps modern organizations defend against relentless identity-based attacks. It continuously identifies and prioritizes millions of identity attack paths to critical assets across the environment, then provides expert guidance to help teams remediate risk. By giving defenders an adversary’s view of the environment, it is the centerpiece of a holistic Attack Path Management practice.

BloodHound Community Edition enables point-in-time assessments of attack paths to Tier Zero assets, helping offensive security pros evaluate identity tech debt and existing configurations during strategic engagements or research.

BloodHound Enterprise

For organizations and technical leaders ready to move from insight to action, BloodHound Enterprise is the right solution, helping build a mature identity attack path management practice that continuously protects critical assets across the hybrid enterprise and eliminates the identity tech debt that puts them at risk.

BloodHound Community Edition

For red teams and practitioners, BloodHound Community Edition provides key insights into identity attack paths during tactical engagements and strategic assessments.

Enterprise Security Features for Hybrid Environments

Continuous attack path management across AD, Entra, GitHub, Okta, MacOS environments… with more SpecterOps-supported extensions coming soon

BloodHound Enterprise Privilege Zones allows organizations to define any asset, group, or environment as a protected zone with continuously monitored attack paths.

Environment-Targeted Access Controls (ETAC) enforces least privilege inside the BloodHound Enterprise platform itself.

Bring Your Own Key (BYOK) gives organizations full control over the encryption keys protecting BloodHound Enterprise data

On-Premises Deployment and FedRAMP-High Authorization are available for organizations with data residency requirements.

Learn More Learn about Privilege Zones

Technical and Tradecraft Expertise

BloodHound Enterprise customers work with a named Technical Account Manager who guides deployment, optimizes data collection across all environments, and runs regular monthly sessions to build internal capability and keep your program advancing.

To accelerate operational maturity, BloodHound Scentry pairs BloodHound Enterprise with our tradecraft experts to accelerate your identity APM practice.

Explore BloodHound Scentry

Compare BloodHound Enterprise and BloodHound Community Edition

Capability/ Value	BloodHound Community Edition	BloodHound Enterprise
Scenario Example	Provides offensive security pros with deep insight into abusable identity conditions during strategic engagements	Defenders continuously detect high-risk attack paths to critical assets and work alongside IAM teams to eliminate them with safe remediation guidance
Continuous attack path mapping
Privilege Zones
Attack Path Prioritization
Attack Path Choke Points
Remediation Guidance
Targeted Access Control
Enterprise Integrations
OpenGraph Findings
Dedicated Technical Account Manager
BloodHound Scentry		Available
On-Prem Deployment		Available
FedRAMP High Authorized		Available

Ready to get started?

See how BloodHound Enterprise eliminates millions of attack paths while focusing your defenses on the routes attackers actually use to reach your critical assets.

Get a Demo