Home  ›  Glossary  ›  Administrative Blast Radius

What is administrative blast radius?

Administrative blast radius is the full set of systems and data that one administrator account or service key can change or destroy if an attacker takes it over. Backups often fall inside that set when the backup system trusts the same identity directory as production.

How does the radius grow?

Privileges accumulate one grant at a time. An administrator account receives rights to servers, then to the hypervisor cluster, then to the backup server and the storage behind it. Each grant has a reason, and together they put one identity inside every layer. An attacker who takes that identity can disable backup jobs, delete repositories and encrypt production in one session. The question that matters after credential theft is therefore what the stolen login can reach.

Why does a shared directory put backups inside the radius?

The most common cause is joining the backup server to the production directory domain so staff can sign in with existing accounts. A domain administrator credential then reaches production servers, the hypervisor, the backup console and, through the console, the repository. One compromised account covers all four. Sophos found that compromised credentials were the root cause of 23% of the ransomware attacks it studied in 2025.

What does identity isolation change?

Identity isolation separates the accounts that manage backups from the accounts that manage production, so taking one does not grant the other. It usually combines several measures:

  • Backup accounts that exist only in the backup system, with no trust relationship to the production domain.
  • Access keys scoped to a single bucket, so a leaked key exposes one set of backups rather than all of them.
  • Separate roles for running jobs, changing settings and managing storage.
  • Retention enforced by the storage itself, outside every account's reach.

The last measure holds even when an identity inside the backup system is taken. With S3 Object Lock in compliance mode, no account, including a storage administrator, can delete locked versions before their retention date. The same principle of minimal access underlies zero trust security, which grants each identity only what its task needs.

How is the radius measured?

The measurement is one question asked per account and per service key: if this credential were stolen, what could it delete or change? Listing every system each backup administrator can sign in to, and every action it can take on stored copies, shows the actual radius, which is usually wider than the organization chart suggests. Quiet changes made inside it, such as a shortened retention period, are backup tampering.

Frequently asked questions

Is blast radius the same as attack surface?

No. Attack surface is how many ways in exist. Blast radius is how much damage follows once one way in is used.

Does multi-factor login shrink the radius?

It makes the account harder to take over, but it does not change what the account can reach once taken. A phished session that passes the multi-factor check still carries every permission the account holds.

Who decides how wide an account reaches?

Usually the security and backup owners together. Backup access is often granted by infrastructure teams who never see the full list of what it touches, which is how the radius widens unnoticed.