Search/ GitHub

For leadership

One stolen password shouldn't be able to take the whole company.

A five-minute briefing on why Active Directory sits at the center of so many breaches, the one number that tells you how exposed you are, and the questions to ask your team.

What good looks like FAQ

Illustration: six runs of an example domain. The number of accounts with an attack path to Tier Zero falls from 8,975 to 0, and Tier Zero protected rises from 53 of 59 objects to 59 of 59. The status starts at Critical, stays High while any account has a path, steps down to Moderate when none does, and reaches Low when nothing at Medium or above is open.

Why it matters

Why Active Directory matters

Active Directory decides who can sign in to what. Almost every Windows computer, file share, email account and business application in a typical organization trusts it. Whoever controls it controls all of them.

That's why attackers go for it. In joint guidance first published in 2024, the national cyber security agencies of Australia, the United States, Canada, the United Kingdom and New Zealand describe Active Directory as routinely targeted in intrusions, warn that sophisticated attackers can stay hidden in it for months or years, and note that removing them can mean rebuilding it.

Attackers rarely need a sophisticated exploit. They start with one ordinary account, usually through phishing, and follow attack paths: chains of everyday permissions that lead, step by step, to full control.

The question isn't whether someone will click a phishing link. It's what that one account can reach when they do.

The number to watch

Accounts with an attack path to Tier Zero

Pathwarden reduces thousands of permissions to one number: how many accounts have an attack path to Tier Zero. It is tracked every run, like uptime or patch compliance. Tier Zero protected is the supporting measure.

Tier Zero exposure

The share of active users and computers outside Tier Zero that have an attack path to it. Lower is better; the goal is 0%.

First run: 8,975 accounts (illustrative)39.9%
After the first fixes: 412 accounts1.8%

Tier Zero protected

The share of Tier Zero objects that no open attack path finding leads to. Higher is better.

First run: 53 of 59 objects (illustrative)89.8%
After the first fixes: 56 of 59 objects94.9%

The trend matters more than any single reading. Each run records both measures, so your team can show progress quarter by quarter. How they're measured.

One page

What good looks like

A mature Active Directory security program, in seven lines. Print this page and use it in your next review.

MeasureTargetWhy it matters
Accounts with an attack path to Tier Zero0, and staying there

No ordinary account can become a domain administrator, so one phished employee stays one incident.

Critical and High findingsNone open without an owner

Each is either being fixed, with a named owner and a date tracked in your ticketing system, or formally accepted.

Tier Zero protectedClose to 100%, rising

Almost nothing that controls the domain is reachable by an attack path.

Assessment cadenceAutomated, at least weekly

New paths appear with every reorganization and project. A yearly penetration test sees one day in 365.

Data completenessComplete, including who signs in where

Otherwise the numbers above are a best case, not the real picture.

Fixes verifiedEvery fix retested

"Done" means a fresh collection shows the path gone, not that a ticket was closed.

Accepted risksFew, each with a reason and a review date

Exceptions are decisions someone owns and revisits, not things that were quietly forgotten.

Questions to ask your team

Five questions for your next security review

You don't need to understand the technical details to ask these. Clear answers are a good sign. "We'd have to check" is a place to start.

  1. How many of our accounts could become a domain administrator?

    Ask for the number of accounts with an attack path to Tier Zero, and how it changed since last quarter.

  2. What are the three changes that would help most?

    Pathwarden's remediation path, its shortlist of fixes, answers this. Ask what's blocking them.

  3. How do we know a fix worked?

    Look for retests, not closed tickets.

  4. Which risks have we accepted, and until when?

    Every exception should have an owner, a reason and a review date.

  5. What are we not seeing?

    Gaps in the data, cloud identity (Microsoft Entra ID) and the systems that manage our servers.

FAQ

Short answers

What does Pathwarden cost?

Nothing. It's open source under the Apache 2.0 license, with no paid tier. The cost is your team's time to run it and make the fixes.

Does our data leave the company?

No. Pathwarden runs on a computer your team controls. There is no cloud service and no account. Results go only where your team configures them to go, such as your own ticketing system or a private repository. A history shared that way can be encrypted with a passphrase.

Is it safe to run against our production directory?

Collection reads the directory, the same way BloodHound collectors do; the analysis itself happens offline on that data and changes nothing. Pathwarden never makes fixes for you: your team decides and applies every change. As with any security tool, run it only with the approval of whoever owns the environment.

Is this a replacement for BloodHound Enterprise?

For on-premises Active Directory it covers the same core model: findings, exposure-based severity, Tier Zero and Privilege Zones, Tier Zero protected, remediation guidance and tracking over time. It doesn't offer vendor support, multi-user access control, managed collectors or Azure resource coverage. See the feature-by-feature comparison.

How mature is it?

Young: version 1.0.0-rc.1. The analysis is tested on lab domains and synthetic forests of up to 500,000 computers. Some parts are newer: the ticketing integrations* and Entra ID support*. The built-in collector* has run on a production domain. Start with a careful rollout in a test environment.

How long does it take to get a first result?

The built-in demo takes minutes. A first report on your own domain takes about 10 minutes once the program is installed, plus the collection time, which depends on the size of the domain.

Who should own it?

Usually the team that runs Active Directory, together with security. Identity administrators fix the findings; security tracks exposure and the trend. Auditors can verify fixes independently with evidence packs.

Share this with your team.

The rest of this site is written for the people who'll do the work: defensive engineers, identity and access engineers and auditors.

What is Tier Zero?

Very new and undergoing testing. These features haven't received a lot of testing yet. Try them out and let us know what's working.

↑↓ to moveEnter to openEsc to close