What it means
Blast radius describes how far harm can spread from a failure, compromise, or operational action. It depends on relationships: permissions, network paths, shared infrastructure, data access, and business dependencies. A small technical change can have a large effect if many services rely on the same identity or component. Security teams use this idea both to contain attackers and to limit damage from their own response actions. Reducing blast radius often means narrowing scope, separating privileges, testing on a small sample, and retaining a practical recovery route.
AN ILLUSTRATIVE SCENARIO
A response rule would disable every nurse
A hospital investigates a stolen clinician account. An automation proposes disabling the directory group that grants access to the clinical portal. That group includes every nurse on the shift. The responder instead scopes containment to the affected identity and evaluates session revocation with the clinical operations lead. The team checks related service accounts and active sessions, but does not assume a broad group change is safer merely because it is faster. Patient-care dependencies shape the containment decision.
Put it to work
- Map what the affected identity, system, or planned action can reach. Include shared accounts, inherited permissions, downstream services, and the business workflows that depend on them.
- Choose the smallest action that meets the response objective. Use explicit resource identifiers, limited batches, previewable targets, and additional review when a change could affect critical shared services.
- Set stop conditions and a recovery plan before acting. Observe a small controlled change, verify its effect, and expand only when the evidence supports the next scope.
How to check your work
In a test or tabletop scenario, list the exact resources an action would change and the users it could interrupt. Confirm that an out-of-scope resource remains unaffected and that the team can detect and stop an unexpected effect.
Connect the ideas
- Least privilege
Granting each identity only the actions, objects, and time window required for the current job.
- Postcondition
The independently checked state of the world that should be true after a response action.
- Availability
The property that authorized people can use a system or record when they need it.