What is blast radius?
Blast radius is the set of systems and data affected if a single identity, credential or component is compromised or misused.
In practice
For an AI agent, the blast radius is everything reachable through its identities and credentials, including systems several steps away. Shared identities enlarge it: if three agents use one service account, compromising any of them gives the combined access.
Reducing blast radius usually means splitting shared identities, scoping roles and removing standing access nobody uses.
Blast radius is the set of systems and data affected if a single identity, credential or component is compromised or misused.
How it works. Step by step.
The parts that make it up, in an environment with AI agents.
What the compromised identity can touch itself.
What it can reach through roles and credentials further along.
Everything other agents on the same identity can reach.
Access that exists all the time, whether it is used or not.
What it looks like in Elmoz
A real path shape, drawn the way the Elmoz security graph shows it.
Questions, answered.
Short answers about Blast radius.
How do you reduce the blast radius of an AI agent?
Give each agent its own identity, scope roles to the task, remove standing access nobody uses and keep production credentials out of reach.
What is the difference between blast radius and an attack path?
An attack path is the route from an entry point to a target. The blast radius is everything that would be affected if one identity on that route were compromised.
Why do shared identities matter so much?
If three agents use one service account, compromising any of the three gives the attacker the combined access of all of them.
Related terms.
Terms that belong to the same picture.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.