Blast Radius Framework™
Know your blast radius.
A structured AWS security assessment that models every propagation path, scores your containment strength, and gives you a sequenced plan to compress exposure — before an incident does it for you.
View Sample Report Schedule an AssessmentSecurity tools find vulnerabilities. BRF maps their blast radius.
Your CSPM flags misconfigurations. Your pentest finds entry points. What neither answers: how far can an attacker move before you stop them? BRF models the full propagation graph — from initial compromise to org-admin — so you know exactly what's at risk, how fast, and what actually stops the spread.
- Long list of findings — no propagation context
- Unknown blast radius per vulnerability
- No path from entry point to crown jewel impact
- Remediation ordered by CVSS, not actual risk
- No containment score to measure improvement
- Every blast path scored and ranked by severity
- Propagation chain from compromise to impact, modeled
- CSI score: measurable containment across 5 domains
- Interventions ranked by impact-to-effort ratio
- 60-day sequenced plan, tied to specific blast paths
Four phases. One complete picture.
-
01 — Structural Surface Mapping
Map every trust relationship, entry class, and privilege boundary in your account. Cross-account trust, environment separation, SAML federation, and CI/CD access chains — fully enumerated and risk-scored.
-
02 — Propagation Modeling
Score and rank every viable blast path from each entry class. Each path shows the full propagation chain, a BPSS severity score, hops-to-admin metric, and linked evidence.
-
03 — Containment Strength Evaluation
Quantify your ability to stop propagation across five domains. The Containment Strength Index (CSI) gives you a single score — and a breakdown that shows exactly where to invest.
-
04 — Risk Compression Plan
Interventions ranked by impact-to-effort ratio, not arbitrary priority. A sequenced 60-day remediation plan, tied to specific blast paths, that reduces the most risk for the least work.
One engagement. Six deliverables.
- Blast Path Register — 20+ propagation paths, each scored by severity band and entry class. Every path links to evidence, affected resources, and the interventions that address it.
- Containment Strength Index — A 0–100 score across five domains: Identity, Network, Data, Compute, and Control. Shows where your containment is holding and where it breaks down.
- Ranked Intervention Matrix — Every control ranked by impact-to-effort ratio, with dependency chains and projected score impact.
- 60-Day Remediation Sequence — A week-by-week plan tied to specific blast paths and interventions.
- Topology & Trust Map — Graph of every node, trust relationship, and privilege boundary.
- Evidence Package — Every finding backed by AWS API data — IAM GetRolePolicy, CloudTrail AssumeRole events, VPC flow logs. Hash-verified and timestamped.
Ready to measure your blast radius?
A BRF engagement typically runs 2–3 weeks for a single AWS account. You get the interactive report, evidence package, and a working session to walk through findings and priorities.