Modern identity ecosystems span on prem Active Directory, Entra ID, and SaaS platforms. These interconnected systems silently create hybrid attack paths that allow adversaries to move laterally across trust boundaries. This session introduces Cross-Domain Graphs, an investigative framework that links open-source intelligence (OSINT) to BloodHound style graph analysis for exposing identity-based risks. Attendees will learn how to collect and enrich public artifacts, safely transform them into graph data, and visualize relationships that reveal privilege escalation routes across multiple identity providers. Using sanitized, reproducible examples, the talk demonstrates how investigative workflows originally designed for digital-forensics and cyber-crime cases can be repurposed for Attack Path Management. We conclude with practical detection queries, least-privilege enforcement steps, and a published mini-repo containing example Cypher queries and graph snippets. Participants leave with a repeatable method to discover and mitigate hybrid identity exposures before attackers do.