Identity Blast Radius

Identity Blast Radius is the count of systems, client environments, and data stores a single compromised credential can reach before anyone notices. Agencies carry an unusually wide radius because one shared vault entry or one over-scoped service account often spans several client tenants at once. The framework asks three questions per identity: what can it reach, who else holds it, and how fast can it be revoked. A password manager with per-client vault separation and event logging shrinks the radius; a spreadsheet of shared logins does the opposite. The radius also grows with non-human identities, since an API key wired into a client's automation stack rarely expires on its own. Recent reporting on agentic security failures makes the point concrete: an offensive agent hijacking an unprotected LLM executed up to 100,000 autonomous attack steps, and a coding agent leaked confidential material through shareable links. Both are radius problems, not password problems. Agencies should map radius before they compare vendor feature lists, because a unified stack that widens reach is worse than a narrow one that contains it.