Your Employees are the Blast Radius

Stolen or misused credentials showed up somewhere in the attack chain of 39% of the breaches in Verizon's 2026 Data Breach Investigations Report, more than any other technique the report tracks. Once attackers are inside, a working account is what they reach for most often, because it draws less attention than a payload that has to break something.

If the account is how attackers move, the useful question for a security team is what an attacker could do while wearing an employee's access like a borrowed badge. The gap between the job a person performs and the damage reachable through their account is where many organizations don’t have any visibility. Most companies log what people open, send, and approve. Companies also need to be able to answer “If this one account were compromised right now, how far would the attacker get, and into what?”

Permissions Accumulate the Way Clutter Does

Nobody sets out to build an over-permissioned employee, but it happens through ordinary career motion. Someone joins as an analyst and gets the analyst bundle. They move to a project team and pick up access to that project's systems. They cover for a colleague on leave and inherit permissions that were only ever meant to be temporary. Then they get promoted, and the new role's access stacks on top of everything they already had, because revoking the old set is somebody's job that is sometimes not quite anybody's job.

Six years in, that person holds the combined entitlements of three or four roles they no longer perform, and their access map looks nothing like their actual responsibilities. Anyone who has run an access review will recognize the pattern: standing privileges that outlived the reason they were granted.

The 2021 Colonial Pipeline ransomware attack shows where can end up. In testimony to the Senate Homeland Security and Governmental Affairs Committee that June, CEO Joseph Blount said the attackers got in through a legacy VPN profile that was not meant to be in use, protected by a single password and no multifactor authentication. Blount also told senators the company still did not know how that password had been obtained. The breach led Colonial to temporarily shut down the largest refined-products pipeline in the country, leaving gas stations in several states dry. The account had been forgotten, and it still opened the door.

The problem compounds with non-human identities. Service accounts, API keys, and now AI agents all carry permissions, and they tend to be granted broadly and reviewed rarely. One ratio estimates 45 non-human identities for every human user in the average enterprise. Each one is another account an attacker can ride.

"Blast Radius" is Reframing the Questions

Borrowed from incident response and infrastructure engineering, blast radius asks a specific question: if this thing fails or is taken over, what is the full set of systems, data, and identities it can reach? Applied to an account, it turns an abstract potential concern into a number you can act on.

Run the math on a single mid-level employee. Their account may touch a finance system they used once on a project, an admin console left over from a prior role, and a shared drive holding three years of customer records. None of that appears in their activity logs, but all of it is available to whoever is holding their password.

This is what moves identity governance out of the IT housekeeping column and onto the security team's board. Deprovisioning and quarterly access reviews were long treated as compliance chores, the kind of thing you did to pass an audit. Once you accept that credentials show up in more breaches than any other technique, every unrevoked permission becomes attack surface that you created and forgot about. Seen that way, the access review decides whether the next incident stays inside one account or spreads across the tenant.

Static Reviews Can't Keep Up with a Live Threat

The standard answer to entitlement creep is the periodic access review: pull the report, ask managers to certify who needs what, and claw back the obvious excess. It helps, and it is also too slow for how attacks unfold. A quarterly review assumes the right level of access is a stable fact you can settle four times a year, but attackers are working on a different calendar.

The more useful model reads entitlement data against live threat intelligence. When intelligence shows a campaign targeting a specific credential type, abusing a particular SaaS integration, or moving through a known technique, the relevant question is immediate: which accounts in our environment carry the access that campaign is built to exploit, and can we contract that access before it lands?

That is the move from governance as record-keeping to governance as defense. It requires two things most organizations keep in separate silos: a current, queryable model of every identity and what it can reach, and a threat intelligence feed wired into that model instead of landing in a different team's inbox. Put them together and a permission becomes something that can tighten in response to what the threat is doing, so the account an attacker wants has already shrunk by the time they reach it.

What This Looks Like in Practice

For a CISO, the practical work starts by treating blast radius as something you measure continuously.  

• Inventory standing privileges against current role. For each account, flag access tied to a position the person has left or a project that has ended. The leftover grants are where Colonial-style exposure lives.

• Quantify reachable systems and data per identity, machine accounts included. Service accounts, API keys, and AI agents often carry the broadest and least-watched permissions, so they belong in the same count as people.

• Wire threat intelligence into the entitlement model. When a campaign targets a known credential type or integration, you want a query that returns the exposed accounts in minutes. A research project that takes a week reports on a campaign that has already moved.

• Track the trend as well as the snapshot. Watch whether blast radius per high-risk identity falls over time. A rising number is an early warning, the same way a climbing mean time to respond is.

The deeper change is architectural. Identity and entitlement data has to live somewhere it can be queried in seconds and joined against threat intelligence. Rebuilding it by hand each audit cycle leaves it stale for most of the year. Whatever the vendor, the principle holds: a blast radius has to be visible before it can be contracted, and it stays invisible as long as entitlement data and threat intelligence live in separate systems.

The employee at the center of all this never did anything wrong. They collected access the way anyone does, by showing up and doing the work for years.  

Measuring blast radius is part of a bigger question: how leadership proves that security decisions hold up. Security Efficiency That Doesn't Increase Risk is a brief that covers traceability, auditability, and the quality thresholds that show leadership whether risk is actually going down.