Threat patterns
What is Blast Radius?
The blast radius of a credential is the systems, data and actions an attacker could reach if that credential were usable. Determine it from the credential’s current validity, identity, permissions, resource policies and possible role chains. Copies of a key show exposure locations, not its access scope; possible access is not evidence that it was used.
More terms in Threat patterns
- NHI Kill ChainCremit’s editorial series on eight recurring credential risk patterns: Ghost, Shadow, Aged, Zombie, Drifted, Over-privileged, Public and Unattributed. Each pattern is a prompt to investigate ownership, current validity, access and evidence; the label alone does not establish compromise.
- Overprivileged NHIA machine identity whose IAM permissions exceed what the workload actually needs. OWASP NHI5:2025 flags this as a top-5 non-human identity risk because the blast radius on compromise is far larger than necessary, a read-only batch job running with admin rights will leak admin-level damage if the credential is stolen. Usually caused by copy-pasting policies, using default roles, or leaving expanded permissions behind after a one-time task.
- Vulnerable Third-Party NHIA third-party NHI is a machine identity or credential used by an external integration to access your systems or data, such as a vendor API key, bot token or OAuth grant. OWASP NHI3:2025 covers risks in these integrations. Record who authorized the connection, what it can access, how it is monitored and how to revoke it.
- Shadow ITAny tool, service, or integration that employees adopt without the security team's knowledge. In the NHI world, shadow IT creates shadow service accounts, shadow API keys, and shadow OAuth grants that never enter the inventory.
- Ghost KeyAn API key or credential that still authenticates, but whose owner has left the company or can no longer be identified. Part of the NHI Kill Chain.
- Over-shared KeyAn over-shared key is one credential copied into multiple projects, environments or tools. Revoking the old value at its issuer disables that value everywhere, but each dependent system needs a replacement and each exposed copy needs review. Shared copies make ownership and migration harder to trace.