Blast Radius Analysis

VeraID’s Blast Radius Analysis answers a critical question: “What happens if this identity is compromised?” By mapping dependencies across resources, policies, and other identities, blast radius analysis helps security teams understand exposure, prioritize remediation, and make informed decisions during incident response.

What-If Simulation

Blast radius analysis performs a forward-propagation simulation starting from a single compromised identity. It traces every resource the identity can access, every policy that grants those permissions, and every downstream identity that could be affected through delegation chains or shared credentials.

Running a Simulation

curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "identityId": "id_svc_deploy_bot",
    "scenario": "FULL_COMPROMISE",
    "includeTransitive": true
  }' \
  https://app.veraid.io/api/v1/analysis/blast-radius

Field	Type	Required	Description
identityId	string	Yes	The identity to simulate as compromised.
scenario	string	No	Compromise scenario. Options: FULL_COMPROMISE, CREDENTIAL_LEAK, PRIVILEGE_ESCALATION. Default: FULL_COMPROMISE.
includeTransitive	boolean	No	Whether to follow transitive dependencies (identity A delegates to B, which delegates to C). Default: true.

Simulation Response

{
  "identityId": "id_svc_deploy_bot",
  "scenario": "FULL_COMPROMISE",
  "blastRadius": {
    "overallSeverity": "CRITICAL",
    "impactScore": 87,
    "directResources": 23,
    "transitiveResources": 41,
    "affectedIdentities": 7,
    "affectedPolicies": 12
  },
  "resourceImpact": [
    {
      "resource": "prod:database:users",
      "actions": ["read:*", "write:*"],
      "sensitivity": "CRITICAL",
      "dataClassification": "PII",
      "accessPath": "direct"
    },
    {
      "resource": "prod:secrets:api-keys",
      "actions": ["read:*", "rotate:*"],
      "sensitivity": "CRITICAL",
      "dataClassification": "CREDENTIAL",
      "accessPath": "direct"
    },
    {
      "resource": "staging:deployments:*",
      "actions": ["deploy:*"],
      "sensitivity": "HIGH",
      "dataClassification": "INFRASTRUCTURE",
      "accessPath": "transitive",
      "via": "id_svc_staging_runner"
    }
  ],
  "policyImpact": [
    {
      "policyId": "pol_prod_deploy",
      "name": "production-deploy-access",
      "effect": "ALLOW",
      "grantedActions": ["deploy:create", "deploy:rollback"],
      "grantedResources": ["prod:deployments:*"]
    },
    {
      "policyId": "pol_secret_read",
      "name": "secret-reader",
      "effect": "ALLOW",
      "grantedActions": ["read:*"],
      "grantedResources": ["prod:secrets:*"]
    }
  ],
  "identityImpact": [
    {
      "identityId": "id_svc_staging_runner",
      "name": "svc-staging-runner",
      "relationship": "DELEGATED_BY",
      "riskIfCompromised": "HIGH",
      "additionalResources": 18
    },
    {
      "identityId": "id_svc_monitoring",
      "name": "svc-monitoring-agent",
      "relationship": "SHARED_CREDENTIAL",
      "riskIfCompromised": "MEDIUM",
      "additionalResources": 5
    }
  ]
}

Dependency Graph Analysis

Blast radius analysis builds a dependency graph that maps relationships between identities, resources, and policies. The graph reveals hidden connections that are not obvious from individual policy definitions.

Relationship Types

Relationship	Description	Risk Implication
DIRECT_ACCESS	Identity has direct policy-granted access to the resource.	Immediate exposure on compromise.
DELEGATED_BY	Identity delegates permissions to another identity.	Compromised identity can act through the delegate.
DELEGATES_TO	Identity receives delegated permissions from another.	Compromise of the delegator expands access.
SHARED_CREDENTIAL	Two identities share a credential or secret source.	Compromising one may expose the other.
SAME_OWNER	Identities share the same human owner.	Owner compromise cascades to all owned identities.
TRUST_CHAIN	Cross-account or cross-platform trust relationship.	Compromise can cross account boundaries.

Caution

Transitive dependencies can dramatically expand the blast radius. An identity with direct access to 5 resources may have transitive access to 50+ resources through delegation chains. Always run simulations with includeTransitive: true for accurate assessment.

Visualizing the Graph

The blast radius API returns graph data that can be rendered as an interactive dependency diagram in the VeraID dashboard. The graph shows:

• Nodes — Identities, resources, and policies.
• Edges — Access relationships, delegation chains, and shared credential links.
• Color coding — Severity-based coloring (critical in red, high in orange, moderate in yellow, low in green).
• Path highlighting — Hover over any resource to see the full access path from the compromised identity.

Resource Impact Mapping

The resourceImpact section catalogs every resource the compromised identity could access, including:

Field	Description
resource	The resource identifier.
actions	Actions the identity can perform on the resource.
sensitivity	Resource sensitivity classification: LOW, MEDIUM, HIGH, CRITICAL.
dataClassification	Type of data: PII, CREDENTIAL, FINANCIAL, INFRASTRUCTURE, PUBLIC.
accessPath	Whether access is direct or transitive.
via	For transitive access, the intermediate identity in the chain.

Danger

Resources classified as CREDENTIAL with direct access paths represent the highest risk. A compromised identity with access to credential stores can extract additional credentials and expand the breach laterally.

Policy Impact Mapping

The policyImpact section lists every policy that contributes to the compromised identity’s access. This helps you understand which policies to modify or revoke during incident response:

• Identify overprivileged policies — Policies with broad wildcards (*) that grant more access than necessary.
• Find policies to revoke — During an incident, deactivate specific policies to contain the blast radius without affecting other identities.
• Assess policy gaps — Discover missing DENY policies that could have limited the damage.

Prioritizing Remediation

Blast radius analysis provides an impact score (0–100) that quantifies the potential damage from a compromise. Use this score to prioritize which identities to harden first.

Remediation Strategies by Impact Score

Impact Score	Priority	Recommended Actions
80–100	Immediate	Reduce permissions, rotate credentials, add DENY policies, assign dedicated owner.
60–79	High	Review and tighten policies, implement rate limits and time windows, ensure MFA on owner.
40–59	Medium	Add monitoring conditions, review delegation chains, schedule credential rotation.
20–39	Low	Standard policy review, ensure baselines are active.
0–19	Minimal	No immediate action needed, include in regular audit cycle.

Comparing Scenarios

Run multiple simulations to compare the blast radius before and after policy changes:

# Before: current state
curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"identityId": "id_svc_deploy_bot", "scenario": "FULL_COMPROMISE"}' \
  https://app.veraid.io/api/v1/analysis/blast-radius

# After: simulate with a proposed DENY policy applied
curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "identityId": "id_svc_deploy_bot",
    "scenario": "FULL_COMPROMISE",
    "simulatedPolicies": [
      {
        "effect": "DENY",
        "resources": ["prod:secrets:*"],
        "actions": ["*"]
      }
    ]
  }' \
  https://app.veraid.io/api/v1/analysis/blast-radius

Tip

Use the simulatedPolicies parameter to test the effect of policy changes before deploying them. This allows you to validate that a new DENY policy reduces the blast radius without inadvertently blocking legitimate access.

Incident Response Workflow

During an active security incident, blast radius analysis integrates into the response workflow:

1. Identify — Threat detection flags an anomaly on a specific identity.
2. Assess — Run blast radius analysis to understand the full scope of potential compromise.
3. Contain — Deactivate policies granting the identity access to critical resources. Rotate compromised credentials.
4. Investigate — Use the dependency graph to trace lateral movement paths and check connected identities.
5. Remediate — Tighten policies, remove unnecessary delegation chains, and reduce the identity’s permission scope.
6. Verify — Re-run blast radius analysis to confirm the remediation reduced the impact score.

Next Steps

• Alerts — Set up automated alerts for high-impact identities and blast radius changes.
• Threat Detection — Detect anomalies that trigger blast radius investigation.
• Security Posture — Monitor your organization’s overall identity security health.