SpecterOps

Name

SpecterOps

Legal name

Specter Ops, Inc.

Website

https://specterops.io

Company type

Private

Founded year

2017

Operating status

Operating

Headcount range

251–500 employees

Ownership category

akta.pro rank

Product category

Cybersecurity Software

NAICS

Computer Systems Design and Related Services (54151)

SIC

Services-Detective, Guard & Armored Car Services (7381)

akta.pro primary industry

Network Security Managed Services (Firewall/IDS/IPS/SASE) (BPAEADAG)

Keywords

• Identity attack path management
• Cybersecurity software
• Adversary simulation
• Offensive security services
• Penetration testing

Headquarters

HQ city

Alexandria

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations

Revenue model

1. BloodHound Enterprise (BHE) subscription: Recurring SaaS subscription for the BloodHound Enterprise platform with 200+ enterprise customers; supports land-and-expand via expanded platform coverage (Okta, GitHub, Mac, Scentry, OpenGraph) and self-managed encryption keys.
2. Professional services (red team, pen testing, assessments, advisory): Adversary-style offensive services including red team engagements, penetration testing, web application security assessments, AI red team, attack path assessments, maturity assessments, program development, and purple team assessments.
3. Training and education: Paid training programs covering Adversary Tactics (Red Team Operations, Identity-Driven Offensive Tradecraft, Detection, Tradecraft Analysis) and Adversary Perspectives (Active Directory, Azure), delivered at Black Hat and other events.

Pricing tiers

Go-to-market motion5 records

Distribution channels6 records

Marketing channels10 records

Core offering

SpecterOps develops cybersecurity software and delivers offensive security services focused on identity attack path management. Its flagship commercial product, BloodHound Enterprise, maps and analyzes Active Directory and Azure identity attack paths, while the firm also publishes several open-source security tools (BloodHound CE, Mythic, Ghostwriter, Nemesis). The company additionally offers professional services including red teaming, penetration testing, and security program development for enterprise customers.

Product overview

SpecterOps delivers a platform-plus-modules portfolio centered on BloodHound Enterprise (BHE), the industry's leading identity attack path management platform for hybrid and AI-enabled enterprise environments. The core BHE platform is extended by modules including Privilege Zones (zone-based access enforcement) and OpenGraph (graphing technologies outside AD/Azure, such as Okta, GitHub, and Mac), and supplemented by the newly launched BloodHound Scentry tool for accelerating attack path remediation. The free, open-source BloodHound Community Edition, plus open-source projects Mythic (C2 framework), Ghostwriter (pen-test reporting), and Nemesis (offensive data enrichment) anchor the community offering. On top of the platform, SpecterOps sells offensive services (Red Team Exercises, Penetration Testing, Web Application Security Assessments, AI Red Team, Attack Path Assessments, Maturity Assessments, Program Development, Purple Team Assessments) and training (Adversary Tactics, Adversary Perspectives). Newer offerings include AI Cyber Ranges for evaluating AI model performance, the GhostWorks AI cyber innovation lab, and the BloodHound MCP developer tool for AI agent integrations.

Differentiator

Problem solved

Functional benefit

Brands

• BloodHound Enterprise: Enterprise platform for identity attack path management across hybrid and AI-enabled environments, including Active Directory, Entra ID, Okta, GitHub, and Mac.
• BloodHound Community Edition
• BloodHound Scentry
• OpenGraph
• Mythic
• Ghostwriter
• Nemesis
• GhostWorks

Products and services

• BloodHound Enterprise Enterprise platform that continuously maps, analyzes, and remediates identity-based attack paths in Active Directory and Azure environments. It is used by enterprise security teams to visualize privilege escalation paths and reduce identity-related risk.
• BloodHound Community Edition Free, open-source attack path mapping tool for Active Directory and Azure that serves as the community counterpart to BloodHound Enterprise. Used by security practitioners, red teamers, and defenders for ad-hoc identity analysis.
• Privilege Zones Capability that lets security teams define, monitor, and enforce zones of privileged access within identity environments to constrain attack path impact. Targeted at enterprise identity and access management teams.
• OpenGraph Extensible data model and ingestion framework that allows organizations to add custom entity types and relationships into BloodHound Enterprise beyond default Active Directory and Azure objects. Used by enterprise security teams to tailor attack path analysis to their environment.
• BloodHound Scentry Detection module for BloodHound Enterprise that continuously monitors identity environments for attack path changes and high-risk conditions, alerting defenders to emerging identity threats.
• Mythic Open-source red team command and control framework used by offensive security operators to collaborate and manage adversary tradecraft across engagements.
• Ghostwriter Open-source reporting and project management tool designed for offensive security teams to automate and standardize the production of client deliverables and engagement documentation.
• Nemesis Open-source data processing and enrichment platform used to ingest, correlate, and analyze data collected during offensive security engagements.
• AI Cyber Ranges Hands-on cybersecurity training and exercise environments, including dedicated AI cyber range scenarios, used by enterprise security teams and individuals to practice defensive and offensive techniques.
• GhostWorks Integrated offensive security operations platform combining command-and-control, reporting, and data enrichment tooling to support managed red team service delivery for enterprise clients.
• BloodHound MCP Integration layer that connects BloodHound Enterprise data to AI assistants via the Model Context Protocol, allowing analysts to query attack path information through conversational interfaces.
• Red Team Services Full-scope adversary simulation engagements in which SpecterOps operators emulate real-world threat actors to test and improve enterprise detection and response capabilities.
• Penetration Testing Targeted, time-boxed technical assessments of enterprise networks, applications, and infrastructure to identify exploitable vulnerabilities and produce remediation guidance.
• Web Application Security Application-layer security assessments covering web apps and APIs, including dynamic testing and code-aware review, designed for enterprise development and product security teams.
• AI Red Team

Quantifiable outcome

• 200+ customers for BloodHound Enterprise
• +2 more outcomes

Named customers7 records

Segments5 records

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration11 records

AI capability12 records

Feature10 records

Partnerships

13 partnerships are on record, tiered flagship and core.

• OpenAIflagshipStrategic or Co-development Partner · 1 April 2026SpecterOps was selected for OpenAI's Trusted Access for Cyber (TAC) program in April 2026, gaining access to advanced cyber-capable models (e.g., GPT-5.4-Cyber) for defensive research. In June 2026 the relationship expanded into the OpenAI Daybreak Cyber Partner Program, with co-developed AI training workshops at Black Hat USA 2026 and embedded AI capabilities (Triage, automated enclave discovery) inside BloodHound and GhostWorks.
• CiscoflagshipStrategic or Co-development Partner · 10 February 2026Announced at Cisco Live EMEA in Amsterdam on February 10, 2026, Cisco and SpecterOps jointly launched Active Directory Defense for Cisco Duo, embedding SpecterOps' identity attack path capabilities into Cisco's Duo security offering.
• TinescoreTechnology or Integration · 4 December 2025SpecterOps and Tines announced a partnership to automate attack path management through a native BloodHound integration, enabling automated attack path identification and mitigation within Tines workflows.
• Kevin Mandia (CEO of Mandiant)coreStrategic or Co-development PartnerStrategic individual investor and advisor participation in Series A extension; provides industry expertise and credibility.
• Microsoft SentinelcoreTechnology or IntegrationNative integration between BloodHound Enterprise and Microsoft Sentinel for security workflow and SIEM integration.
• Palo Alto NetworkscoreTechnology or IntegrationIntegration of BloodHound Enterprise with Palo Alto Networks products for identity attack path management.
• ServiceNowcoreTechnology or IntegrationIntegration of BloodHound Enterprise with ServiceNow for security workflow and remediation management.
• OktacoreTechnology or IntegrationCoverage of Okta identity environments in BloodHound Enterprise for attack path detection and remediation, announced March 2026.
• GitHubcoreTechnology or IntegrationBloodHound Enterprise coverage of GitHub environments for cross-platform attack path mapping (via OpenGraph), announced March 2026.
• Apple (Mac)coreTechnology or IntegrationAdded Mac environment coverage in BloodHound Enterprise for hybrid attack path detection, announced March 2026.
• Amazon Web Services (AWS)coreTechnology or IntegrationAWS is SpecterOps' cloud hosting provider and infrastructure partner, leveraging AWS security certifications and isolated single-tenant architecture for BloodHound Enterprise.
• UK AI Security InstitutecoreStrategic or Co-development PartnerCollaboration with the UK AI Security Institute applying SpecterOps' adversary tradecraft knowledge across public and private engagements.
• BloodHoundGang Slack CommunitycoreOthersOperates and hosts the BloodHoundGang Slack community (slack.specterops.io) as a core channel for tradecraft sharing and project collaboration.

Scale indicators8 records

Recent moves6 records

Expansion highlights7 records

Broad incumbents

• CrowdStrike: Endpoint and cloud security leader whose Falcon Identity Threat Detection and Falcon Identity Threat Protection overlap with SpecterOps' identity attack path focus, but CrowdStrike operates as a broad platform across EDR, SIEM, and identity rather than specializing in attack-path mapping.
• Microsoft (Defender for Identity / Security Copilot): Owner of Active Directory and Entra ID with native Defender for Identity and Security Copilot capabilities that increasingly cover identity attack-path analytics. SpecterOps lists Microsoft as both a customer (BloodHound Enterprise) and a partner (Microsoft Sentinel integration), making Microsoft both a competitor and ecosystem participant.
• Palo Alto Networks (Cortex / Unit 42): Broad cybersecurity platform with Cortex XSIAM and Unit 42 attack-path-adjacent services, and a disclosed integration partner of BloodHound Enterprise. Competes at the platform layer while cooperating at the integration layer.
• Tenable: Vulnerability management leader extending into identity and exposure management (Tenable Identity Exposure / formerly Tenable.ad) with BloodHound-style AD attack-path visualization. Closest large-cap competitor in identity attack path management.
• Wiz: Cloud security platform with identity-aware cloud detection and response (CDR) capabilities and acquisition-driven identity exposure analytics. Competes indirectly by extending attack-path visibility into cloud and identity from a cloud-native base.

Direct peers

• BeyondTrust: Privileged access management vendor offering identity security, AD/Entra auditing, and attack-path-adjacent capabilities. Closely aligned with SpecterOps' focus on identity-driven lateral movement and privilege escalation.
• CyberArk: Privileged access management leader offering identity security, just-in-time access, and identity threat detection that overlap with BloodHound Enterprise's identity attack path management focus.
• Obsidian Security: Identity threat detection and response (ITDR) vendor focused on SaaS and identity provider attack paths. A direct competitor to BloodHound Enterprise in the emerging identity threat detection category.

Emerging players

• Saviynt: Cloud-native identity governance and administration platform with converged identity security, including risk-aware identity analytics that intersect with SpecterOps' attack-path prioritization capabilities.

Others

• Semgrep (and emerging code/identity security players): Developer-first security vendor; representative of the broader ecosystem of code and identity security companies that could converge on attack-path and identity-exposure analytics, complementing or competing with SpecterOps' BloodHound platform.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat7 records

Key risks6 records

Key highlights7 records

Customer concentration

• GitHubgithub.com/SpecterOps
• Xx.com/specterops
• LinkedInlinkedin.com/company/specterops

Compliance8 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles9 records

Funding overview

Funding rounds5 records

Investors6 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A1 record

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about SpecterOps