A while back I sat through a demo of BloodHound Enterprise. It's a great product. It does exactly what defenders need: it watches your Active Directory, finds the attack paths into Tier Zero, tells you which ones to close first, and tracks whether you actually closed them.
Then I saw the quote. It was close to a million dollars a year.
I want to be careful here, because I like the people who make BloodHound and I owe them a lot. That number buys real things: a company behind the product, support, a managed service, features I don't have. For a huge enterprise it may well be worth it.
But I kept thinking about everyone else. The hospital system. The school district. The regional bank with a security team of four. They have the same Active Directory problems, the same forgotten service accounts with a path to Domain Admin, and nowhere near that budget. For them, attack path management is a once-a-year pen test and a PDF.
That's the gap. I didn't think it needed to exist. So I built Pathwarden, and here's the six-minute tour.
What I believed it needed to be
I had three rules from the start.
No servers. BloodHound Community Edition is free, and it's wonderful for exploring a graph. But it's a stack of containers, a graph database and a Postgres database, and SpecterOps recommends 96 GB of memory once you're past 50,000 users. Most of the teams I'm thinking of can't stand that up, let alone keep it running. So Pathwarden is one executable. You copy it somewhere and run it.
Easy to use. You shouldn't need to be a graph theory nerd to get value out of this. There's a friendly app with buttons, and a command line for the people who want one. Collecting takes a regular domain account and a few questions.
Actionable. Thousands of attack paths isn't an answer. "Remove this one permission, from this group, on this object, and 4,000 accounts lose their path to Domain Admin" is an answer. Every finding comes with the fix, the PowerShell to do it, how to check it and how to roll it back. And because every run is saved in a history, you can see whether you're getting better over time, not just whether you're broken today.
Open source made this possible
None of this starts from scratch, and I want to say that loudly.
Open source security tooling is in an incredible place right now. BloodHound taught all of us to think in graphs. RustHound-CE, by g0h4n, is the collector Pathwarden is built on. SharpHound, AzureHound, PingCastle and a whole community of researchers did the hard thinking about what an attack path even is.
A good example happened this week. Someone reported a bug in RustHound-CE: one kind of permission on the domain root was being dropped, which hid Exchange's well-known path to DCSync. g0h4n fixed it within days. We found it, pulled the same fix into Pathwarden the same afternoon, and it ships in the first release candidate. That's how this is supposed to work.
What AI-assisted development changed
This is the part I've thought about the most.
Pathwarden is a big piece of software. There's a graph engine, a collector, a remediation planner, a report, a desktop app, ticketing integrations, encrypted history, and a lot of tests. A year ago, one person building that in their spare time would have been a fantasy.
AI-assisted development changed the math. It let me move at the speed of my ideas instead of the speed of my typing. I could describe what a feature should do, review what came back, push back when it was wrong, and keep going.
What it didn't change is just as important. AI doesn't know your domain. It doesn't know which findings matter to a tired admin at 4 PM on a Friday. It will happily write code that passes its own tests and is still wrong. So the hard parts stayed hard and stayed mine: deciding what to build, saying no to features, testing against real directories, running an adversarial security review of the whole product, and reading every word the app shows a user.
The result isn't "AI wrote a security tool". It's that one practitioner with strong opinions could build something that used to take a funded team.
Does it actually work?
For the last month, Pathwarden has run in production in a large environment: multiple Active Directory forests, multiple Entra ID tenants, about 2.3 million objects in all. Peak memory was 6.2 GB. The collection is read-only.
That's the number I care about most. Not because it's big, but because it means this runs on a laptop or a modest server, not a cluster.
What it isn't
Pathwarden isn't BloodHound Enterprise, and I won't pretend otherwise. There are no user accounts or single sign-on. There's no REST API. There's no company to call at 2 AM. If you need those, the enterprise products exist for good reasons.
What Pathwarden is: free, open source, one program, and focused on the question that matters. What do I fix first, and did it work?
Try it
The first release candidate of Pathwarden 1.0 is out, with signed Windows builds and Linux builds. Everything is at pathwarden.org.
Run it on your own domain. Tell me what's working, what's confusing, and what's missing for the way your team works. Attack path management shouldn't be a luxury.
Go find that path before someone else does.
-Marbaṩ