Compare
Self-hosted CNAPP and open-source attack paths
People looking for a self-hosted CNAPP or open-source attack paths already run one of three tools. Prowler is the check catalog. Cartography is a graph without a prioritized queue. BloodHound is identity paths, in an on-prem Active Directory shape. OpenSourceOM is the cloud graph that scores a finding because it sits on a path.
| Tool | What you get | Where it stops |
|---|---|---|
| Prowler | Thousands of compliance checks. A findings list, and in Prowler App an AWS attack-path graph built with Cartography. | The graph is a second database, and today it is AWS. |
| Cartography | A Neo4j graph of cloud and identity relationships, plus Cypher rules that return matches. | You pick the query. Matches are not a scored queue. |
| BloodHound | Identity attack paths: which principal can reach a high-value one, through membership, sessions, and ACLs. On-prem AD, and Entra ID via AzureHound. | The nodes are principals. A public workload and a datastore are a different graph. |
| OpenSourceOM | A self-hosted Postgres graph. Six named attack paths. CSPM findings scored by internet reachability, a path to a datastore, and admin access. AWS, Azure, GCP, and Kubernetes. | A smaller check catalog. No Cypher. No on-prem Active Directory. |
Prowler
Prowler is the check catalog. Each result is a control, a resource, and a pass or fail, mapped to CIS and the other frameworks. Prowler App can also build an AWS attack-path graph with Cartography. The catalog is larger than OpenSourceOM’s. The head-to-head, including when to keep both, is Prowler vs OpenSourceOM.
Open-source attack paths
Cartography syncs cloud, identity, and SaaS APIs into Neo4j. Cartography Rules runs Cypher and prints the rows. You can ask exposure and identity-to-data questions the schema supports, once you write or select the query. Nothing in that pipeline turns the rows into “fix this one first.”
OpenSourceOM ships the walks.
om paths list prints six names.
The one that sorts a weekly queue is internet-to-datastore: from the internet,
through a workload, ending on a datastore. The same names are on the API and in the console.
There is no query language. A question you have not named yet belongs in Cartography.
BloodHound
BloodHound walks identity paths in an on-prem Active Directory shape: users, groups, computers, sessions, and ACLs. The question is which principal can reach a high-value one. AzureHound collects Entra ID into that same shape. Domain Admin and Global Admin paths belong here.
OpenSourceOM does not collect on-prem AD. Its walks start at the internet and end on a datastore, through network and workload nodes. Identity blast radius is which cloud assets an identity can reach.
Self-hosted CNAPP
Self-hosted means the collectors, Postgres, API, CLI, and console run in your environment. The license is Apache-2.0. The slice in the open-source core is the security graph, CSPM rules scored by path, the six named attack paths, and CVE enrichment from packages and images already in inventory. Runtime agents, SAML, multi-tenant RBAC, and insider-threat analysis sit outside that core. A longer map of the open-source landscape is the 2026 CSPM and CNAPP survey.
Which one to run
- A compliance workbook with hundreds of controls: Prowler.
- A Cypher question you still have to write: Cartography.
- A path inside Active Directory or Entra ID: BloodHound.
- Which cloud finding sits on a path from the internet to data, on a host you operate: OpenSourceOM.
Prowler and Cartography can run beside this. They answer a question the ranked queue does not.
Questions
How is OpenSourceOM different from Cartography?
Cartography stores a Neo4j graph and lets you write Cypher. OpenSourceOM stores a Postgres graph and ships six named walks, then ranks findings that sit on them. A question you have not named yet belongs in Cartography.
What is a self-hosted CNAPP?
A self-hosted CNAPP runs collection and correlation in your infrastructure. OpenSourceOM covers the security graph, CSPM, and attack-path parts of that, under Apache-2.0. You operate Postgres, the API, the CLI, and the console. Runtime agents, SAML, and multi-tenant RBAC are outside the open-source core.
What are open-source attack paths?
An attack path is a walk from an entry point to something an attacker wants. Cartography stores a Neo4j graph and lets you write Cypher. OpenSourceOM stores a Postgres graph and ships six named walks, then ranks findings that sit on them. BloodHound walks identity edges in Active Directory and Entra ID.
How is OpenSourceOM different from BloodHound?
BloodHound answers which principal can reach a high-value admin, through membership, sessions, and ACLs. That graph has an on-prem Active Directory shape, extended to Entra ID with AzureHound. OpenSourceOM answers which cloud finding an outsider can walk from the internet to a datastore. It does not collect on-prem Active Directory.