Know Your Adversary

In this episode of Know Your Adversary, Jared Atkinson and Justin Kohler sit down with SpecterOps researcher Raj Patel to discuss his discovery of vulnerabilities that bypass SMB and LDAP signing protections through reauthentication and NTLM relay attacks. What began as research into Kerberos relay led to findings that challenge long-standing assumptions about one of Active Directory’s most trusted security defenses.

Raj walks through the discovery process, the role of AI-assisted research using OpenAI Codex, and how these vulnerabilities could enable attackers to compromise Active Directory environments through techniques like shadow credentials and DC Sync. The conversation also explores Microsoft’s patches, the ongoing risks of NTLMv1, and what defenders should prioritize to better protect their domain controllers.

In this episode of Know Your Adversary, Jared Atkinson and Justin Kohler are joined by Sahan Fernando to discuss cybersecurity in healthcare and its direct connection to patient care. Sahan shares his perspective on managing identity risk, balancing security remediation with clinical needs, and navigating the challenges of bringing two organizations together during a merger.
The conversation explores how AI is accelerating attacks, why connected identity systems create risks that can be difficult to see, and how BloodHound helps make those relationships clearer. They also discuss communicating risk to leadership, prioritizing limited resources, and using privilege zones to better protect the systems that support critical medical operations.

In this episode of Know Your Adversary, Jared Atkinson and Justin Kohler sit down with Hope Walker and Elad Shamir to discuss Microsoft’s emerging agent identity ecosystem and the security challenges that come with it. They break down how agents, identities, blueprints, flows, and supporting resources interact across Microsoft platforms, and why understanding those relationships is becoming increasingly important.

The group explores how agent identities can cross traditional boundaries, inherit access through different identities, and introduce new attack paths. Hope and Elad discuss their work modeling these relationships in BloodHound to move beyond simple agent inventories and visualize who can control an agent, what identities it can act as, and what resources it can ultimately reach.

They also look at the challenges of securing a rapidly changing technology, from citizen-developed agents and overprivileged identities to MCP servers and evolving Microsoft permissions. The takeaway is that agents don’t operate in isolation, and understanding their security impact requires connecting them to the broader Entra and Azure graph.

In this episode of Know Your Adversary, Jared Atkinson and Justin Kohler are joined by Daniel Heinsen and Julian Catrambone to discuss bringing AWS attack paths into BloodHound. Daniel and Julian share how their work evolved from manually analyzing complex AWS policies to mapping relationships across accounts, identities, and resources to better understand where exposure actually exists.

The conversation explores why AWS permissions and trust relationships become so difficult to reason about at scale, how seemingly isolated configurations can combine into attack paths with significant downstream impact, and what the team has learned from testing this approach in real-world environments. They also dig into third-party trust, cross-platform attack paths spanning technologies like GitHub and AWS, and why understanding paths to critical resources matters just as much as identifying paths to privileged identities.

In this episode of Know Your Adversary, Jared Atkinson and Justin Kohler are joined by Vlad Rotshteyn to discuss what effective attack surface and exposure management looks like inside a large enterprise.Vlad shares his path from enterprise IT into cybersecurity and how that experience shaped his approach to security. The conversation explores why visibility across assets, identities, vulnerabilities, and security tooling is critical to understanding where an organization is actually exposed.

The group also digs into moving beyond vulnerability severity to prioritize risk with context, how Attack Path Management and BloodHound can provide a clearer picture of exposure, and why better visibility can sometimes make security metrics look worse before they get better. They close with Vlad’s perspective on AI, the importance of asking the right questions, and why new technology can’t replace strong security fundamentals.

In Part 2 of Know Your Adversary’s celebration of 10 years of BloodHound, Jared Atkinson and Justin Kohler are joined once again by BloodHound creators Andy Robbins, Will Schroeder, and Rohan Vazarkar. Picking up where Part 1 left off, the group explores how lessons from the original BloodHound and the Active Directory Adversary Resilience Assessment (ADARA) helped turn attack path analysis into a methodology defenders could operationalize, ultimately laying the groundwork for BloodHound Enterprise.
The conversation dives into a fundamental challenge they discovered along the way: defenders can’t simply enumerate and fix every attack path. Instead, they need to understand what’s wrong, how much it matters, and what to fix first. The group discusses how this realization shaped BloodHound’s approach to prioritization, tier-zero isolation, continuous monitoring, and giving defenders the context they need to reduce attack path risk as identity environments constantly change.
From there, they trace BloodHound’s expansion beyond on-premises Active Directory into Azure, hybrid identity environments, GitHub, and other platforms. They share the technical and engineering challenges of modeling increasingly complex systems at enterprise scale, how experimentation with GitHub helped accelerate the development of OpenGraph, and why extensibility became essential to BloodHound’s future. The episode closes with a look toward what comes next, including new attack graph coverage and the continued expansion of BloodHound into emerging identity systems.

In this episode of Know Your Adversary, Jared Atkinson and Justin Kohler are joined by Andy Robbins, Will Schroeder, and Rohan Vazarkar, the original creators of BloodHound, to celebrate ten years since the tool was first introduced. Together, they revisit the offensive security challenges that led to BloodHound and how a need to understand increasingly complex Active Directory environments ultimately led them to graph theory and attack path analysis.
The discussion traces BloodHound's evolution from a tool built by red teamers to solve their own operational problems into an open source project that changed how practitioners understand identity-based attack paths. The group shares stories from its early development and DEF CON debut, the expansion from a simple graph of three node and edge types, and the realization that BloodHound wasn't creating attack paths, but providing a map of relationships and opportunities that had been there all along.
Along the way, they explore how BloodHound changed offensive tradecraft, why visualization made complex attack paths easier to understand, and how defenders began using the same capabilities to find and eliminate those paths at scale. They also reflect on the project's transition from an offensive tool toward a defensive capability, setting the stage for BloodHound Enterprise and the next chapter of BloodHound's evolution.

In this episode of Know Your Adversary, Jared Atkinson and Justin Kohler are joined by HD Moore, CEO of runZero. Drawing from decades of experience in offensive security, vulnerability research, and network discovery, HD shares his perspective on how defenders can better understand the real attack surface of modern enterprise environments.

The discussion explores the intersection of identity and network security, including RunZeroHound, HD's BloodHound OpenGraph project that brings network topology and exposure data into attack path analysis. The group examines how security dependencies, hidden connectivity, and infrastructure exposure create opportunities for attackers that traditional vulnerability management often misses.

Along the way, they discuss OT and industrial networks, the myth of air-gapped environments, the growing impact of AI on offensive security, and why understanding how systems are connected may be more important than understanding individual vulnerabilities.

In this episode of Know Your Adversary, Jared Atkinson and Justin Kohler are joined by Robin Unglaub, creator of TaskHound, an open-source BloodHound OpenGraph extension designed to uncover credential exposure and attack paths hidden within Windows scheduled tasks. Drawing from years of offensive security experience, Robin explains how a common administrative feature can become a valuable source of privilege escalation and lateral movement opportunities for attackers.

The discussion covers how scheduled tasks store and use credentials, why they frequently appear during security assessments, and how TaskHound helps operators and defenders visualize these relationships directly within BloodHound. Robin also demonstrates how graph-based analysis can reveal tier-zero exposure, identify high-value targets, and uncover misconfigurations that might otherwise go unnoticed.

Along the way, the group explores OpenGraph, operational security considerations, and upcoming TaskHound features that expand visibility into additional credential sources across enterprise environments.

In this episode of Know Your Adversary, Jared Atkinson and Justin Kohler are joined by Javier Azofra from Siemens Healthineers, where he leads the continuous assessments team focused on enterprise security posture. Javier shares how his team approaches identity security and the challenges of maintaining visibility across complex environments.The conversation focuses on how security gaps emerge between systems like Active Directory, Entra ID, and CyberArk. Javier explains how his team built a BloodHound OpenGraph integration (CyberArkHound) to connect these platforms and uncover hidden attack paths that weren’t visible in isolation. They also break down how CyberArk models users, safes, and accounts—and how those relationships can unintentionally enable privilege escalation.Along the way, they discuss how attackers exploit identity relationships, why MFA and PAM don’t eliminate risk on their own, and how defenders can better prioritize remediation by understanding cross-platform attack paths.