- 01Across 200 cloud environments analyzed by Alexa Research between mid-2024 and early 2026, blast radius from common entry points consistently exceeded the customer's expectation by an order of magnitude.
- 02Methodology: model an attacker who has compromised a specific entry point (CI runner, developer laptop, third-party SaaS with cloud federation), then compute reachable resources via static reachability analysis on current IAM, network, and application access.
- 03Findings: median blast radius from CI runner compromise is 47 production resources, from developer laptop 89, from third-party SaaS with federation 31. Median 'expected' blast radius reported by the customer: 4.
- 04Where the gap comes from: long-lived service principals with broad scope, federation tokens with lifetimes in hours not minutes, IAM trust relationships no one re-evaluated after the original use case retired. The fix is rarely architectural — it is hygiene at scale.
Across 200 cloud environments analyzed by Alexa Research between mid-2024 and early 2026, we measured the blast radius of compromise from common entry points. The numbers consistently exceeded the customer's expectation by an order of magnitude.
How we measured
We modeled an attacker who has compromised a specific entry point (a CI runner, a developer laptop, a third-party SaaS account with cloud federation). We then computed the set of cloud resources reachable from that identity given current IAM, network, and application-layer access — using static reachability analysis, not actual exploitation.
What we found
- 01Median blast radius from CI runner compromise: 47 production resources
- 02Median blast radius from developer laptop: 89 production resources
- 03Median blast radius from third-party SaaS with federation: 31 production resources
- 04Median 'expected' blast radius (asked the customer): 4
Where the gap comes from
Long-lived service principals with broad scope. Federation tokens with lifetimes measured in hours, not minutes. IAM trust relationships that no one re-evaluated after the original use case retired. The fix is rarely architectural — it is hygiene at scale.