BloodHound OpenGraph is an open graph data model for representing identity and permission relationships in an attack path analysis tool. It lets practitioners query nodes and edges such as users, groups, computers, sessions, and delegated rights, so they can map privilege relationships and identify paths to administrative access.
What BloodHound OpenGraph Represents
BloodHound OpenGraph is a relationship model, not just a visualisation layer. Its value is in turning identity data into queryable graph objects, so analysts can ask how privileges, memberships, sessions, and delegation connect across an environment.
That makes it useful for attack path analysis because privilege is rarely granted in a single step. Instead, access is often the result of chained relationships, inherited rights, indirect group membership, or delegated control that only becomes obvious when the environment is modelled as a graph.
How the Graph Models Identity and Access
The model typically centres on nodes such as users, groups, computers, and sessions, then connects them with edges that describe who can authenticate, who can act through whom, and where administrative influence exists. Those edges are what let practitioners trace routes from ordinary accounts to higher privilege.
In practice, this is why graph-based analysis is so effective for directory environments: the question is not only who has access, but how that access is inherited, delegated, or reachable through another object. A graph model makes those transitive relationships explicit and queryable.
Why Attack Path Graphs Matter
Attack path analysis focuses on reachable privilege, not just assigned privilege. A graph can expose excessive group membership, delegated rights, and session relationships that create paths an attacker could abuse after initial compromise. For that reason, BloodHound and Active Directory Attack Path Guide is a natural companion for understanding how administrators prioritise choke points and remediation order.
Graph data also helps separate high-value administrative exposure from ordinary membership noise. If a low-privilege account can reach a privileged session, a delegated control, or a computer with trusted access, the path itself becomes a security finding even before any direct compromise occurs.
Operational Use in Assessment and Remediation
Practitioners use the graph to answer two questions: what paths exist today, and which changes reduce those paths fastest. That usually means identifying risky edges, then removing unnecessary rights, tightening delegation, and reducing the number of accounts that can bridge into administrative tiers.
Collection quality matters too. If the underlying data is incomplete, stale, or biased toward one directory segment, the graph can understate exposure. A useful graph model therefore depends on disciplined collection, clear asset coverage, and repeated review as the environment changes. For related tradecraft around movement paths, Lateral Movement Guide helps connect graph findings to the techniques that attackers often use once they find a viable route.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0008 — Lateral Movement | OpenGraph is used to map reachable paths attackers can exploit across identity relationships. |
| Recommendation — Map discovered paths to lateral movement techniques and prioritise controls that break traversal routes. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The graph exposes excessive effective access and privilege chaining that least privilege should reduce. |
| AU-6 — Audit Review, Analysis, and Reporting | Graph outputs support review of identity relationships and abnormal access paths for investigation. | |
| CA-7 — Continuous Monitoring | OpenGraph depends on recurring collection and re-analysis of changing identity relationships. | |
| Recommendation — Review graph-revealed privilege chains and remove unnecessary permissions that create reachability. Correlate graph findings with audit data to validate suspicious access paths and privilege changes. Continuously refresh identity graph data so new risky edges and reachable privilege are detected early. | ||
| CIS Controls v8 | CIS-5 — Account Management | The model highlights excessive, stale, or misassigned accounts and memberships that create paths. |
| Recommendation — Use account management controls to remove unnecessary memberships and dormant privileged access paths. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org