Blast radius
What an attacker reaches from one compromised account or VM, across every platform, and which fixes break the most paths.
Account
Host
VM
Crown jewel
Seen in config
Inferred from policy
Matched by IP
Declared by you
Rings numbered by steps from the compromised point · shaded area = current reach · red = attacker reach · blue = your fix
How the attacker gets there
Collect this to confirm
Routes that need one hop VSAT could not verify. They are never counted as attack paths or ranked; collect the named evidence to confirm or rule them out.