ContactBook a demo

Blast radius

Assume the key is stolen.Know what it reaches.

Blast radius is the set of resources an identity can reach through every credential, role and trust relationship it holds — resolved from the identity graph and ranked by what matters. It turns a leaked key into a list: here is what that key's identity can touch, starting with what is high-impact.

AvailableIdentity graph · Credential Security · M3

Book a demoExplore effective access

Resolved from the identity graph · ranked by impact · carried as evidence in findings

The problem

A leaked key is not a string problem.

The question in the first ten minutes of an incident is never which secret — it is what that secret's identity can reach right now, and which of those things matter.

Reach is transitive

A CI token reaches a role, the role reaches an account, the account trusts production

Strings have no radius

A scanner finds the secret; only the graph knows what the identity behind it can reach

Criticality is context

Ten reachable buckets matter less than one customer database

How it works

Start at the identity. Follow everything it holds.

Blast radius is computed on the same graph as ownership and effective access, so the answer includes the hops a per-account view cannot see.

  1. Start at the identity

    Not at the credential: every key and token the identity holds is included

  2. Follow every credential

    Each credential authenticates to services; each service exposes the resources behind it

  3. Resolve effective access

    Role chains, trust policies and cross-account assumption extend the reachable set

  4. Rank by impact

    Reachable resources are ordered by the impact an operator classified and the privilege level held

Explore the identity graph

What you get

Reach, ranked and explained.

Not a number: a list of resources with the path to each, the privilege held and the grant that makes it reachable.

Reachable resources

List every repository, workload, account and server an identity can reach, wherever a connector collects resources

Ranked by impact

See high-impact resources first, with the privilege level on each

Path to each resource

Open any resource to see the credential, role chain and trust that reach it

Reach in findings

Carry reach to high-impact resources as evidence in identity and credential findings

Grant named per resource

Each reachable resource names the role, trust or binding that makes it reachable

Risk over time

Recorded risk history shows how an identity’s risk moved as roles and trusts changed

Containment

Shrink the radius from the finding.

A blast radius is only useful if it leads to a smaller one. Each reachable resource is tied to the grant that makes it reachable, so the recommendation is specific: scope this role, rotate this key, remove this trust. Trustivan proposes the change for a second person's approval; the change at the provider is made by a person.

  • Grant named first, so the change is specific, not a guess.
  • Owner in the loop, because every action needs a human decision and a record.
  • Evidence after the fix, with the radius re-resolved on the next sync.

Availableassign owner · quarantine in platform · ticket recorded

Future capabilityrotate · scope · revoke at the provider

Explore NHI governance
HighUnowned identity

svc-billing-exportlong-lived key · reachable production data

  1. Assign ownerAssign the team accountable for it; the change is written to the audit trailevidence: owner record · actor · time
    Available
  2. Quarantine in platformMark the identity quarantined; the runtime gate then denies every action it attemptsevidence: lifecycle change · actor · time
    Available
  3. Record a ticketRecord a ticket or an owner notification against the finding; no ITSM or SIEM integration yetevidence: ticket record · actor · time
    Available
  4. Rotate credentialReplace the 611-day access key at the provider — proposal and second-person approval are recorded today; execution is notevidence: proposal · approval · no provider executor
    Future capability
  5. Scope roleReduce export-admin at the provider; which permissions are used is not observedevidence: proposal · effective access re-evaluated
    Future capability
  6. Revoke at providerDisable the key at AWS when compromise is suspectedevidence: proposal · approval · no provider executor
    Future capability
Every action is written to the audit trail with actor, time and evidenceIllustrative · sample environment

NHI Security

Continue through the pillar

Blast radius depends on the inventory, ownership and effective access that come before it — and feeds risk and governance after.

Know the blast radius before the incident does.

A demo resolves the reach of one identity — credentials, role chains, trusts, resources — and names the grant behind each.

Book a demo