Topic starter
02/08/2026 11:54 am
TL;DR: A university found that 84 phished credentials led to 482 verified impact paths, 257 compromised hosts, and domain compromise in 19 minutes, according to Horizons.ai. The result shows why phishing awareness metrics alone miss the security question that matters most: how far an attacker can go after one credential is exposed.
Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “From Patch Tuesday to Pentest Wednesday®: A University’s Journey to Measure Blast Radius”.
By the numbers:
- 482 verified impacts were mapped from the phished credentials.
- One credential had access to 3.7 million data resources and was linked to 319 distinct attack paths.
Key questions
Q: What breaks when phishing simulation programmes rely only on click-through rates?
A: Click-through rates alone create a narrow and often misleading view of risk.
Q: Why do phished credentials create such large internal impact in some environments?
A: Because the credential is only the starting point.
Q: How can teams tell whether phishing controls are actually working?
A: Look for fewer successful credential submissions on lookalike domains, lower password reuse, and faster reporting of suspicious messages.
Practitioner guidance
- Measure post-authentication blast radius Use phishing simulations or controlled compromise exercises to test what a submitted credential can actually reach, including privilege escalation, host compromise, and domain-level paths.
- Prioritise high-leverage identities Identify the small set of accounts that account for most critical attack paths and reduce their reach first, rather than treating all exposed credentials as equal.
- Collapse excessive permissions Remove write access, administrative overlap, and legacy entitlements that allow one compromised user to touch many systems or data stores.
Bottom line: Phishing awareness data can look healthy while the access model still lets one compromised account create domain-wide risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:03 pm
Blast-radius reduction is the right control objective for phishing risk. Click rate measures whether a lure worked. It does not measure whether the identity and authorization model lets one compromised credential reach critical systems, sensitive data, or administrative control. For practitioners, the important question is not who clicked, but how far that click can travel.
A question worth separating out:
Q: What should teams do first when phishing exposure is already widespread?
A: Teams should first reduce the blast radius by tightening identity controls and removing unnecessary privilege. That means enforcing stronger verification for access, limiting endpoint permissions, and improving detection for unusual behaviour across email and systems. Once the environment is harder to exploit, organisations can prioritise user training, response playbooks, and monitoring for repeated attacker patterns.
👉 Read our full editorial: Blast radius beats click rate in phishing risk measurement