Notifications
Clear all
Topic starter
05/07/2026 9:29 pm
TL;DR: Overprovisioning, access accumulation, and SaaS and AI sprawl make identity blast radius the real damage multiplier in breaches, according to Zluri’s analysis. Faster detection helps, but without tighter provisioning, review, and offboarding controls, attackers still inherit far more access than the compromised identity should have had.
NHIMG editorial — based on content published by Zluri: All The Identity Blast Radius Problem: How Overprovisioning Turns Every Breach Into a Bigger One
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: What breaks when identity blast radius is not controlled?
A: When identity blast radius is not controlled, a single compromised account can reach far more systems, data, and workflows than its current job should allow.
Q: Why do overprovisioned identities make breaches worse?
A: Overprovisioned identities increase breach damage because the attacker inherits every unnecessary entitlement already attached to the account.
Q: How do organisations know if blast radius reduction is actually working?
A: Blast radius reduction is working when the discovered access footprint is shrinking, excess entitlements are being removed continuously, and long-tenured identities stop carrying historical permissions.
Practitioner guidance
- Baseline the full identity footprint Inventory every entitlement, including SaaS tools, OAuth grants, shared credentials, and AI-connected applications, so containment is based on the actual access set rather than the governed subset.
- Reclaim access from privilege creep Run targeted reviews on long-tenured identities, especially users with repeated role changes, project handoffs, or informal exceptions, and remove permissions that no longer map to current duties.
- Treat offboarding as access revocation, not checklist completion Verify that leaving users, contractors, and service owners lose every relevant credential, token, and linked application grant, including tools outside the core IAM system.
What's in the full article
Zluri's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how overprovisioning compounds breach impact across SaaS, cloud, and collaboration tools
- Detailed comparisons between detection controls and access-governance controls for blast-radius reduction
- The article’s own framing of identity blast radius as a provisioning problem, including practical examples from IAM programmes
- Operational discussion of how SaaS and AI sprawl create access outside normal governance scope
👉 Read Zluri's analysis of identity blast radius and overprovisioning →
Identity blast radius and overprovisioning: where IAM teams miss?
Explore further
05/07/2026 9:32 pm
Identity blast radius is not a response problem first. It is a provisioning problem that only becomes visible during response. Detection and phishing resistance reduce the time an attacker has, but the damage ceiling is still set by the access that was already granted. That means the governance function, not the SOC alone, determines how far a compromise can travel. Practitioners should treat excess entitlement as pre-breach damage already waiting to be used.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which leaves most identity programmes unable to measure blast radius accurately.
A question worth separating out:
Q: Who is accountable for reducing identity blast radius?
A: IAM and identity governance teams are accountable for reducing identity blast radius because provisioning, review, offboarding, and SoD decisions determine the damage ceiling before an attack occurs. Security operations can shorten exposure, but they cannot fix broad access that was left in place by governance processes.
👉 Read our full editorial: Identity blast radius: how overprovisioning magnifies breach damage
