What is blast radius?
Blast radius is the set of systems and data affected if a single identity, credential or component is compromised or misused.
- Blast radius is what one compromised identity would affect before anyone stops it.
- It is measured in systems and data, not in severity scores.
- For an agent it is larger than for a person, because an agent moves in seconds and does not pause.
- Reducing it is an access change, not a detection improvement.
Published Last reviewed
In practice
For an AI agent, the blast radius is everything reachable through its identities and credentials, including systems several steps away. Shared identities enlarge it: if three agents use one service account, compromising any of them gives the combined access.
Reducing blast radius usually means splitting shared identities, scoping roles and removing standing access nobody uses.
Blast radius is the set of systems and data affected if a single identity, credential or component is compromised or misused.
What makes a radius large.
Four properties, each of which multiplies rather than adds.
| Property | Why it widens the radius |
|---|---|
| Shared identity | Everything using it is affected at once, and rotating breaks all of them. |
| Assumable roles | Reach extends past the direct permissions, often far past. |
| Readable secrets nearby | The compromise picks up credentials it was never granted. |
| Destructive permissions | The damage becomes irreversible rather than observable. |
How it works. Step by step.
The parts that make it up, in an environment with AI agents.
What the compromised identity can touch itself.
What it can reach through roles and credentials further along.
Everything other agents on the same identity can reach.
Access that exists all the time, whether it is used or not.
What it looks like in Elmoz
A real path shape, drawn the way the Elmoz security graph shows it.
Questions, answered.
Short answers about Blast radius.
How do you reduce the blast radius of an AI agent?
Give each agent its own identity, scope roles to the task, remove standing access nobody uses and keep production credentials out of reach.
What is the difference between blast radius and an attack path?
An attack path is the route from an entry point to a target. The blast radius is everything that would be affected if one identity on that route were compromised.
Why do shared identities matter so much?
If three agents use one service account, compromising any of the three gives the attacker the combined access of all of them.
Keep reading.
Pages that belong to the same picture.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.