Blast radius
The blast radius is the maximum extent of the damage a compromised, hijacked or misused identity can cause before it is contained.
- Synonym
- impact radius
Definition
In IAM, blast radius is not measured only by the number of entitlements. It also depends on the resources actually reachable, the data accessible, the actions possible, whether the identity can read, modify, delete or execute, how long the privileges remain valid, which APIs and tools are reachable, the pivot paths towards other systems, and the downstream identities or agents the access indirectly lets you act through. An account with read access to a single SharePoint site has a limited blast radius; an account able to read, modify and share every SharePoint site in the organisation has a far larger one, even though both use the same authentication technology.
Why it matters
Design IAM assuming an identity will be compromised one day. The question is not only "can it access?" but "how far can it go if something goes wrong?".
The Ariovis perspective
Reducing the blast radius means least privilege, temporary Just-in-Time privileges, segmentation, narrow scopes, fine-grained authorization, contextual decisions and Policy Enforcement Points placed as close as possible to the resources.
Related services
Common pitfalls
- Investing heavily in strong authentication in front of an identity that then holds extremely broad powers: the entry is hardened, the reach is not.
Standards and protocols
- NIST SP 800-207
Resources
Explore this category
These concepts matter most inside a real project.
The first conversation helps establish your context, the systems involved and the next useful decision.