Glossary
Blast Radius
Blast radius describes the scope of harm available to an attacker (or a malfunctioning automated process) once they control a single point in a system — one stolen credential, one compromised service, one misbehaving agent. A system with a small blast radius limits what any one identity can reach; a system with a large one lets a single compromise cascade into a much larger incident.
Reducing blast radius usually means combining several controls at once: least privilege so each identity's reach is narrow, network and data segmentation so a compromised component cannot freely reach unrelated systems, and fast revocation so a detected compromise can be cut off before it spreads. None of these controls is sufficient alone — a narrowly scoped identity in a flat network can still reach far more than intended, and fast revocation is no help if the initial access was already broad enough to do damage instantly.