Blast Radius
Blast Radius helps you evaluate the potential impact of a compromised identity. It shows the access available to an identity and the resources, privileged groups, and Tier 0 assets an attacker might reach after compromising that identity.
Unlike Attack Path Analysis, which identifies how an attacker can reach a target asset, Blast Radius focuses on the access available after an attacker gains control of a specific identity.
View Blast Radius
- Navigate to ETM Identity > Risk Management > Attack Path Analysis > Blast Radius.
- Select the identity that you want to investigate.
- Review the visualized access paths.
The analysis helps you determine:
- Resources the identity can access
- Privileged groups that are reachable from the identity
- Potential paths for lateral movement
- Exposure to Tier 0 assets
Analyze Suspicious Paths
Use the Suspicious Paths option to display only high-risk access paths associated with the selected identity.
When suspicious paths are available, the view filters the results to show only paths that require investigation or remediation. This helps you focus on the most critical security risks.
Review Access
Blast Radius displays the relationships associated with the selected identity. This information helps identify:
- Reachable privileged groups
- Tier 0 assets
- High-risk permission chains
- Potential lateral movement opportunities
By reviewing these relationships, you can understand the security impact of a compromised identity and prioritize risk reduction activities.
Expected Results
Blast Radius displays attack paths only when the selected identity can reach a Tier 0 asset through one or more relationships.
If a path exists between the selected identity and a Tier 0 asset, Blast Radius displays the reachable attack paths, allowing you to understand potential privilege escalation and lateral movement opportunities.
If the selected identity cannot reach a Tier 0 asset anywhere in the path, Blast Radius does not display attack paths. Instead, only the selected source identity is displayed in the Blast Radius view. This behavior helps indicate that no reachable Tier 0 exposure was identified for the selected identity.
- Blast Radius currently focuses only on Tier 0 objects in attack paths.
- Currently, we support Blast radius upto 5 hops limit in the current release.
- When no reachable Tier 0 asset exists, only the source identity is displayed.