Blast radius beats click rate in phishing risk measurement

At a glance

What this is: This is a case study showing that phishing awareness metrics can look healthy while a single phished credential still enables domain compromise and broad internal impact.

Why it matters: It matters because IAM and security teams need evidence of post-compromise reach, not just user training outcomes, when deciding whether access controls actually reduce risk.

By the numbers:

• 84 users entered their credentials during the early 2025 phishing impact test.
• 482 verified impacts were mapped from the phished credentials.
• 257 compromised hosts were identified in the early 2025 test.
• One credential had access to 3.7 million data resources and was linked to 319 distinct attack paths.

Context

Phishing measurement is often too narrow because it stops at the click or credential submission event. In this case, the security problem was not whether users fell for a lure, but how far an attacker could move after authenticating with a compromised identity.

That distinction matters for identity governance because excessive permissions, legacy systems, and accumulated access can turn one submitted password into domain-wide exposure. The article shows a university learning to measure consequence instead of awareness alone.

The topic is especially relevant to phishing testing, privileged access governance, and identity blast-radius analysis in environments where access sprawl has outgrown visibility.

Key questions

Q: What breaks when phishing simulation programmes rely only on click-through rates?

A: Click-through rates alone create a narrow and often misleading view of risk. They miss whether employees report suspicious messages, how quickly they escalate concerns, and whether certain roles face higher exposure. Without those signals, teams can overstate progress, underprioritise privileged users, and fail to spot patterns that predict real incidents.

Q: Why do phished credentials create such large internal impact in some environments?

A: Because the credential is only the starting point. Large blast radius appears when identity sprawl, overbroad entitlements, and internal trust let one authenticated user reach many hosts, systems, or data sets. The issue is not phishing alone, but the access model that turns one stolen login into broad leverage.

Q: How can teams tell whether phishing controls are actually working?

A: Look for fewer successful credential submissions on lookalike domains, lower password reuse, and faster reporting of suspicious messages. If users still reach fake login pages and can submit credentials without friction, the control environment is only reducing risk on paper. The goal is to stop secrets from leaving the user’s device.

Q: What should teams do first when phishing exposure is already widespread?

A: Teams should first reduce the blast radius by tightening identity controls and removing unnecessary privilege. That means enforcing stronger verification for access, limiting endpoint permissions, and improving detection for unusual behaviour across email and systems. Once the environment is harder to exploit, organisations can prioritise user training, response playbooks, and monitoring for repeated attacker patterns.

Technical breakdown

Why click rate is a weak security metric for phishing

Click rate measures user behavior at the point of deception, not the technical consequence of compromise. A phished credential becomes useful only after authentication succeeds, at which point the real questions are entitlement scope, lateral movement paths, and whether legacy permissions still connect to high-value systems. In identity-heavy environments, one valid login can unlock many attack paths if role design, authorization boundaries, and segmentation are loose. That is why training metrics can improve while exposure stays high: the measurement target is upstream of the real risk.

Practical implication: measure what a compromised identity can reach, not just who clicked.

How phishing impact testing maps post-authentication blast radius

Phishing impact testing takes a submitted credential and exercises it like an attacker would, then traces the reachable systems, permissions, and weaknesses from that identity. The value is in chaining access with exploitability, because a credential with minimal privilege should terminate quickly while an over-entitled one can fan out across hosts and data resources. This is closer to adversary emulation than awareness training. It answers a governance question the simulation alone cannot: which identities create the largest downstream impact if exposed?

Practical implication: use authenticated testing to identify which accounts create the highest attack leverage.

Why identity sprawl turns a single credential into domain compromise

Identity sprawl means permissions accumulate across users, service accounts, and legacy systems until access paths no longer match current business need. When that happens, a single compromised account can inherit access to data, administrative channels, or weak internal systems that were never intended to be connected. The article shows this clearly through privilege escalation and attack-path chaining leading to domain compromise in minutes. That is not a phishing problem alone. It is an access design problem exposed by phishing.

Practical implication: tighten the accounts and pathways that create the largest internal reach first.

Threat narrative

Attacker objective: The objective is to turn one phished credential into privileged internal reach that can compromise hosts, expose sensitive data, and control the domain.

1. Entry occurred when users submitted credentials in a phishing simulation, creating authenticated access that an attacker could reuse.
2. Credential abuse followed as the compromised logins were authenticated inside the environment and mapped for reachable permissions and weaknesses.
3. Escalation and lateral movement came next as exploitable paths were chained into broader host compromise and domain control.
4. Impact was measured in verified attack paths, compromised hosts, exposed PCI-classified data, and domain-wide compromise.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Blast-radius reduction is the right control objective for phishing risk. Click rate measures whether a lure worked. It does not measure whether the identity and authorization model lets one compromised credential reach critical systems, sensitive data, or administrative control. For practitioners, the important question is not who clicked, but how far that click can travel.

Phishing awareness metrics can improve while governance failure remains unchanged. The university in this article had low click rates and still discovered domain compromise, excessive data exposure, and hundreds of verified impacts. That is a measurement mismatch, not a security victory. The implication is that identity governance has to be validated through consequence testing, not awareness reporting.

Identity sprawl turns small access mistakes into structural risk. When permissions accumulate across legacy systems and poorly scoped accounts, the environment creates its own blast radius. This is where IAM, PAM, and segmentation intersect: if entitlement scope is too broad, phishing becomes the trigger that reveals the design flaw.

Outcome-based governance should replace activity-based reporting for phishing programmes. Awareness exercises still matter, but they are only one layer of a control stack. Security leaders need proof that the same credential would fail to reach domain control after remediation. That moves the programme from training completion to measurable exposure reduction.

Blast radius is the named concept that should replace click rate as the executive metric. It captures the true question this case raises: what happens after identity is compromised? That is the metric that aligns with identity security practice, because it tests whether the access model limits impact when prevention fails.

What this signals

Blast radius is the governing metric for phishing resilience: a low click rate can coexist with a large internal attack surface if compromised identities still have broad reach. Security programmes should therefore validate the consequences of successful credential theft, not just the likelihood of user error.

The practical shift is from activity reporting to consequence control. When one phished account can touch many assets, the work is about reducing the paths that matter most, then proving they stay collapsed after remediation.

For practitioners

• Measure post-authentication blast radius Use phishing simulations or controlled compromise exercises to test what a submitted credential can actually reach, including privilege escalation, host compromise, and domain-level paths.
• Prioritise high-leverage identities Identify the small set of accounts that account for most critical attack paths and reduce their reach first, rather than treating all exposed credentials as equal.
• Collapse excessive permissions Remove write access, administrative overlap, and legacy entitlements that allow one compromised user to touch many systems or data stores.
• Retest remediation against the same attack path Repeat the same adversary-driven exercise after changes to confirm that the original paths no longer chain into domain compromise or widespread exposure.

Key takeaways

• Phishing awareness data can look healthy while the access model still lets one compromised account create domain-wide risk.
• The university’s test turned credentials into 482 verified impacts and 257 compromised hosts, which is the kind of evidence click-rate reporting never reveals.
• The control question is whether remediation actually shrinks the attack paths that matter, because that is what determines whether a phished login becomes an incident.

Key terms

• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Phishing Impact Testing: Phishing impact testing uses real or simulated compromised credentials to measure what an attacker could actually do after initial access. It moves beyond awareness metrics by validating escalation paths, lateral movement, and sensitive data exposure in a live environment or safe simulation.
• Identity Sprawl: Identity sprawl is the uncontrolled growth of identities, entitlements, and credentials across an environment. For NHIs, it usually appears when automation creates accounts faster than governance teams can inventory, review, and remove them. The result is hidden access, weak accountability, and a wider attack surface.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.