Blast Radius Analysis
Reachability, computed before the investigation starts
Blast radius is the set of assets, data stores, and accounts reachable from a compromised entity via existing access relationships. ManySignal computes it from the entity graph at alert time — so the first thing an analyst sees is scope, not a blank case.
<50 ms
blast radius computation time
3 hops
default graph depth
100%
of alerts include a radius score
Asset tags
weight critical vs standard
How blast radius is calculated
Starting from the compromised entity node, the blast radius engine performs a bounded graph traversal following access-type edges: has-permission, member-of, assumes-role, owns-resource. Each node reached is scored by asset criticality — a path that reaches a production database or a privileged IAM role is weighted higher than one that reaches a sandbox environment.
The result is a numeric score (0–100) and a categorized set: accounts reachable, data stores reachable (with classification labels), and systems reachable. The score and category summary appear on the alert card before the case is opened.
Low (0–30)
Reachable assets are low-criticality, sandboxed, or already isolated
Medium (31–70)
Some production assets or shared accounts reachable within 2 hops
High (71–100)
Critical data stores, privileged accounts, or production systems reachable
What blast radius enables
Priority before triage
A low-confidence alert touching a blast radius of 80 is more urgent than a high-confidence alert with a radius of 5. Blast radius feeds directly into alert prioritization.
Containment planning
The categorized radius tells responders which accounts to suspend, which data stores to monitor for exfiltration, and which systems to isolate — before the investigation concludes.
Guardrail input
Playbook guardrails can use blast radius as a condition: automatically block bulk actions if the radius is below 20, require approval if it is above 50, and require senior approval above 80.
Exec-level communication
The radius score translates technical exposure into business risk language. 'This alert has a blast radius of 78 including two PCI-in-scope databases' is faster to communicate than a log dump.
Historical comparison
Blast radius scores are stored with each finding. Trend analysis shows whether your organization's average exposure is growing or shrinking as access controls improve.
MSSP SLA tier input
For MSSPs, blast radius score can drive automatic SLA tier assignment: radius above a threshold auto-assigns a P1 SLA regardless of the detection rule's default severity.
Blast Radius — FAQ
How deep does the traversal go?
The default traversal depth is 3 hops from the compromised entity. This covers direct access, group membership, and inherited role permissions. Depth is configurable up to 6 hops, with higher depths adding latency.
What if an account has hundreds of permissions?
High-degree nodes are traversed with a fan-out limit: only edges leading to nodes with a criticality score above a configurable threshold are followed. Low-criticality leaf nodes are counted in aggregate rather than individually.
Does blast radius account for network segmentation?
Network segmentation data from firewall and security group ingestion is included as edge weights. A path that crosses a segmentation boundary is penalized in the traversal, reducing the effective blast radius score.
Can I override the blast radius score for a specific entity?
Yes. Entity tags can include a blast_radius_multiplier that scales the computed score up or down. This is useful for labeling honeypot accounts as low-risk regardless of their graph neighbors.
How does blast radius affect the autonomy ladder's response decisions?
Each action class can be configured with a blast-radius threshold — if the affected entity's score exceeds the threshold, the action escalates to approve-gated regardless of the general autonomy tier. A high blast-radius alert is never automatically contained without human review unless explicitly configured.
How is blast radius communicated to analysts in the case UI?
Blast radius appears as a 0–100 score with a colour band (green/amber/red) on the finding header and case overview. Clicking the score opens the graph traversal view showing the exact reachable resources, their criticality, and the path through the entity graph.
Can blast radius estimates be wrong and how is that handled?
Yes — blast radius is an estimate based on observed relationships. Unobserved permissions (out-of-band access grants not captured in telemetry) can cause underestimation. Analysts can manually annotate a case with an adjusted blast-radius assessment; the annotation is stored in the evidence trail.
Is blast radius recomputed if the entity graph changes during an incident?
Blast radius is computed at alert creation time and stored as a point-in-time estimate. If the investigation reveals the entity has gained additional access since the alert fired, analysts can trigger a recomputation from the case detail panel. The original and updated estimates are both preserved in the case timeline.
How does blast radius help prioritise which incidents to investigate first?
The SOC queue can be sorted and filtered by blast radius score. P2 alerts with blast radius above 70 can be surfaced above P2 alerts with blast radius below 20, even at the same severity tier. Teams use this to focus analyst attention on incidents with the highest potential impact.
See scope before you investigate
Blast radius is the first number you see on every alert. Book a demo to see it computed on your own environment.