Hybrid attack paths threaten the entire system.

Securing a single platform is really hard, just ask any Active Directory or Entra ID admin. We’ve used the analogy before but think of a single Active Directory domain or Entra ID tenant as a map of the United States. Instead of cities connected by roads, these environments are identities and resources linked by privileges and user behaviors. The number of attack paths within a single domain or tenant is higher than the number routes across within the United States. If that wasn’t bad enough, attack paths rarely stay confined to a single system.

An attacker who compromises a user account in Active Directory might leverage that access to escalate privileges in an identity provider. From there, they may gain access to device management platforms or developer infrastructure, eventually reaching sensitive systems like production environments or critical source code repositories. A cross-platform pivoting through Active Directory, Entra ID, Okta, and Github These chains of privilege are often difficult to detect because the relationships that enable them exist across multiple platforms. Worse yet, these configurations often sit between administrative teams. A Github admin and an Okta admin can configure everything “correctly” within the view of their given platform.

However, the hybrid connections that connect these two platforms unravel the security of both. The new BloodHound Enterprise is designed to expose exactly these kinds of relationships. By mapping how identities and resources interact across environments, BloodHound helps defenders visualize the paths an attacker could take; and prioritize the remediation steps that break those paths before they can be exploited.