Glossary
What Is Blast Radius?
Published Last updated
Blast radius is the set of systems, services and customers that one failure or compromise can reach before it is contained. In infrastructure it is measured outward from a shared dependency, such as a nameserver, hosting provider or network, and counts everything that stops working or becomes exposed when that one piece goes wrong.
How Whisper models it
Blast radius is a shared dependency read backwards: from one nameserver, IP or network, walk to everything else that relies on it.
MATCH (d:HOSTNAME {name:"github.com"})<-[:NAMESERVER_FOR]-(ns:HOSTNAME) RETURN ns.name LIMIT 10Why it matters
Security teams usually measure risk one asset at a time. Blast radius asks a different question: if this one thing fails, what else goes with it? The answer is rarely inside the asset. An outage at a single DNS provider has taken many unrelated companies offline at once, and a compromised hosting account exposes every site that shares its servers.
The idea sits beside concentration risk and choke point analysis. Concentration risk measures how much depends on one supplier. Choke point analysis finds the node whose removal cuts the most paths. Blast radius measures the damage when that node is hit. Incident responders use it to decide what to notify and isolate first, and architects use it to decide where a second provider is worth paying for. During an incident it also runs in reverse: once one affected customer is known, the shared dependency behind it points to the others.
How it appears in the graph
Blast radius is a dependency read backwards. WhisperGraph stores each dependency as an edge in Connection Types; start at the shared node and follow the edge in reverse:
- `NAMESERVER_FOR`, reversed: every domain one nameserver serves.
- `RESOLVES_TO`, reversed: every hostname on one address.
- `ROUTES`, reversed: every prefix behind one network.
For networks, the ASN node also records the size of its customer cone in coneAsns, conePrefixes and coneAddresses: the networks and address space that reach the internet through it. That gives a first estimate of how far a routing incident at a transit provider would spread, before you run a traversal at all.
The same walk works for email. A shared SPF include, or a mail vendor that signs for many domains, is a dependency like any other: follow SPF_INCLUDE or DKIM_SIGNED_BY back from it to see which domains would be affected if it were misconfigured or compromised.
Where this shows up
See it in a live investigation: What happens if one of your vendors goes down?
Go hands-on with the attack-path recipes.
