SpecterOps is a security company that describes its focus as Identity Attack Path Management from an attacker’s perspective, and the company states that it “secures identity for the AI enterprise”. Its commercial platform, BloodHound Enterprise, continuously maps and prioritises identity attack paths to critical assets across human, non-human, workload and AI identities. SpecterOps lists David McGuire as Chief Executive Officer. The core idea behind the platform is a graph of identities, privileges and trust relationships, which shows how separate weaknesses chain together into a route to compromise and where a single change can cut many of those routes. Alongside the platform, SpecterOps offers BloodHound Community Edition, open-source tools, training and services. This overview explains how the platform works and what it covers, based on SpecterOps’s public product documentation and announcements.
At A Glance
| Vendor | SpecterOps, led by Chief Executive Officer David McGuire |
|---|---|
| Category | Identity attack path management |
| Identities covered | Human, non-human, workload and AI identities |
| Deployment | SpecterOps-hosted SaaS or self-hosted on-premises |
| Environments | Active Directory, Entra ID, AWS, Okta, GitHub and Jamf-managed Macs, with further sources through OpenGraph |
| Agentic AI | BloodHound Hunter agent interface; mapping of agentic identities |
| Customers | The SpecterOps website lists OpenAI, Anthropic, Palantir, JPMorgan, Chevron, SAP, Anduril, ExxonMobil and Microsoft |
| Market classification | Identity Security Posture Management; also Identity Threat Detection & Response |
What The Platform Does
SpecterOps groups its platform into attack path management with BloodHound Enterprise, BloodHound Community Edition, integrations, AI adversary operations, AI red teaming and AI cyber ranges. This overview concentrates on BloodHound Enterprise.
Attack Path Mapping
SpecterOps states that BloodHound Enterprise identifies and prioritises attack paths across identity providers, cloud platforms, applications and repositories. The company describes the aim as showing “how disconnected weaknesses chain into meaningful compromise”, and says the platform shows the environment as it is configured in real time rather than relying on documentation. It also states that the platform exposes the real access a user holds after authentication, at the point where MFA and PAM treat them as legitimate identities.
Prioritisation And Remediation
BloodHound Enterprise is positioned around a continuous, risk-guided programme for removing the most critical attack paths. SpecterOps describes identifying the chokepoints that sever pathways, so that one fix removes many paths at once. Teams can assign ownership and SLAs to attack paths to track remediation. The company reports that “BloodHound Enterprise customers see an average 35% reduction of risk in the first 30 days” and that cutting a single choke point severs access to more than 17,000 attack paths on average.
Findings
The documentation explains that findings include exposure and impact metrics that quantify risk, and that teams can expand finding details for remediation guidance. There are two kinds:
| Relationship-based findings | Can have both an exposure metric and an impact metric, because the risk comes from connections between principals. |
|---|---|
| List-based findings | Identify a vulnerability in a specific principal where the risk originates from the principal itself, and carry an impact metric only. |
Findings are organised by the environment of the target nodes.
Privilege Zones
Privilege Zones let organisations define the boundaries that matter most in their environment, including multiple privilege tiers for business-critical applications, regulated systems and sensitive groups or data. By default, BloodHound includes a Tier Zero zone, which represents a set of objects with full control over an environment.
| Zone | A group of objects that represents a hierarchy of control across identity providers and services, based on access level. An object can belong to only one zone at a time. |
|---|---|
| Label | A flexible way to categorise objects for searching and filtering. An object can belong to several labels. |
BloodHound Enterprise flags a violation of the privilege model when an object in a lower-privileged zone controls an object in a higher-privileged zone, for example a Tier One user that can control a Tier Zero server.
How The Architecture Works
SpecterOps documents two deployment options with the same core functionality. The company presents SaaS for organisations that want SpecterOps to manage infrastructure and updates, and on-premises for organisations that require data to remain within their own infrastructure.
| Component | What it does |
|---|---|
| SaaS | The SpecterOps-hosted version of BloodHound Enterprise, with infrastructure and updates managed by SpecterOps. |
| On-premises | A self-hosted option on infrastructure the customer owns. An embedded cluster packages BloodHound Enterprise and a bundled Kubernetes cluster (k0s) for deployment on a single Linux host. |
| SharpHound Enterprise | A collector that runs as a Windows service for on-premises Active Directory and AD CS collection. |
| AzureHound Enterprise | A collector that runs as a containerised service for Entra ID, Azure Resource Manager and Microsoft Graph collection. It can be installed on Windows, Docker or Kubernetes. |
| OpenGraph | A framework that, in SpecterOps’s words, unifies identity data across distributed and hybrid environments into a single attack path graph. The documentation describes it as a way to ingest any data source and map attack paths. |
The documentation describes SharpHound Enterprise and AzureHound Enterprise as providing continuous, automatic collection of attack path data, which is uploaded for processing and analysis. BloodHound also offers a REST API.
Agentic AI Capabilities
BloodHound Hunter
SpecterOps describes BloodHound Hunter as “a purpose-built agent interface within BloodHound Enterprise”. The company states that Hunter is read-only, respects existing user permissions and keeps data authoritative in BloodHound Enterprise.
AI Identities And Attack Paths
SpecterOps states that BloodHound Enterprise maps agentic and human identities, privileges and known attack techniques, and that it continuously maps how effective privilege forms across hybrid human-machine environments. The company also says it prioritises the attack paths most likely to be abused by AI-assisted adversaries. SpecterOps reports that it has joined OpenAI’s Trusted Access for Cyber programme to bring Daybreak AI capabilities to BloodHound Enterprise. The product pages do not state whether these AI features are in beta or generally available.
Integrations
| Area | Documented integrations |
|---|---|
| Enterprise-supported OpenGraph extensions | AWS, Okta, GitHub, Jamf Pro |
| Community OpenGraph extensions | Ansible AWX and Ansible Tower, Cisco Duo Security, GitLab, Kubernetes, PingOne, RACF on z/OS mainframes, runZero, Microsoft Exchange on-premises, Microsoft Windows |
| SIEM and SOAR | Google Security Operations, Splunk SIEM, Splunk SOAR, Palo Alto Cortex XSOAR, Tines |
| Ticketing and IT workflow | ServiceNow Security Incident Response, ServiceNow Vulnerability Response, Jira |
| Asset and identity | Axonius, Quest Software, Cisco Identity Intelligence for SAML 2.0 logins |
The Splunk SIEM app, for example, lets customers ingest path, posture and impacted principals data, while the Jira integration is an Atlassian Forge app that syncs automatically with BloodHound Enterprise.
Use Cases And Industries
SpecterOps presents BloodHound Enterprise for organisations that want to find and remove identity attack paths to critical assets in hybrid environments, protect privileged tiers with Privilege Zones, and reduce detection noise by removing the attack paths behind many alerts. Customers named on the SpecterOps website include OpenAI, Anthropic, Palantir, JPMorgan, Chevron, SAP, Anduril, ExxonMobil and Microsoft. SpecterOps also offers services including AI red teaming, penetration testing, attack path assessments and purple team assessments, and BloodHound Scentry, which it describes as combining BloodHound Enterprise with SpecterOps expertise to accelerate attack path management practices. The company states that over 95% of red teams rely on its open-source work, which includes BloodHound Community Edition, Mythic, Ghostwriter and Nemesis.
This overview is compiled from SpecterOps’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.