Vendor Breach Exposure Map (Hub and Spoke)
Your vendors hold keys to your systems. If one of them were breached tomorrow, how much would the attacker get, how quickly could you take it back, and could you even list what they held? Add your vendors, answer six questions about each, and see them ranked on a hub-and-spoke map. Everything runs in your browser.
Vendors that hold your credentials or access
Type a name for each vendor you use. Rows without a name are ignored. Add as many as you need.
Hub and spoke
Name at least one vendor to draw the map.
How the score works
Exposure = 2 x what the keys reach + credential lifetime + network restriction + time to rotate + unknown keys. Each factor is 0 to 3 points, so the top score is 18. The weights are a planning choice, not measured data.
- What the keys reach: 0 to 3 points, counted twice.
- Lifetime: short 0, a mix 2, long-lived 3.
- Network restriction: in place 0, possible but not done 2, not possible 3.
- Time to rotate everything: hours 0, days 1, weeks or longer 3.
- Unknown keys: know them all 0, most 1, could not say 3.
- Bands: high at 60% of the maximum or more, medium from 35%, otherwise lower.
TL;DRWhat this tool is
5 points
- List the vendors that hold your credentials or access: CI/CD, secrets manager, source host, neocloud, AI platform, monitoring.
- For each, say how long its credentials live, whether they can be tied to your networks, what the keys reach, how fast you could rotate them and whether you know every key it holds.
- You get an exposure score per vendor, a ranked "restrict first, replace first, rotate first" list and a hub-and-spoke diagram.
- The formula is shown on the page: 2 x what the keys reach, plus lifetime, restriction, rotation time and unknown keys, 0 to 3 points each. It is a planning model, not a measurement.
- Runs entirely in your browser. Nothing is uploaded.
One hub, many spokes
magoo's retrospective describes attackers who compromised companies that support development and infrastructure and then collected their customers' long-lived credentials. In his account, GitHub tokens gave access to internal repositories that held more secrets, and many owners could not say what a given key was, which slowed rotation. He also observed that many of the keys could have been role-based credentials or used Workload Identity Federation, and that log readiness predicted how long response took. These are his observations of the incidents he followed, not universal findings.
You cannot stop a vendor from being breached. You can choose how much its breach is worth to an attacker. This map shows where your keys are long-lived, unrestricted, wide-reaching and hard to rotate, so the first fixes go where they matter most.
Sources
- magoo, “Black October: Lessons From the Downstream Breaches”, Starting Up Security, Oct 2026.
Frequently asked questions
What is a hub-and-spoke breach?
In "Black October: Lessons From the Downstream Breaches" (Starting Up Security, Oct 2026), magoo describes a stretch of breaches at companies that support developers and infrastructure, where attackers collected many of those companies' customers' long-lived credentials such as GitHub personal access tokens, long-lived AWS keys and AI platform keys. One vendor (the hub) held keys that opened many customers (the spokes). The pattern is the author's description of the incidents he observed.
Why does "do we know every key it holds?" matter?
The author observed that many owners could not tell what a key was, which made rotation hard. If you cannot list the keys a vendor holds, you cannot rotate them in order, and you cannot tell customers or regulators what was exposed. The unknown-keys factor adds points for that reason.
What do restrict, replace and rotate mean here?
Restrict means tie the credential to networks you trust. Replace means swap a long-lived key for a role, workload identity or short-lived token. Rotate means issue new credentials and retire the old ones in a safe order. The tool picks the cheapest lever that fits each vendor and lists the rest of its reasoning.
Is the score a risk probability?
No. It ranks your own vendors against each other using the answers you give. It says nothing about how likely any vendor is to be breached, and the weights are a simple planning choice.
Does it store my vendor list?
No. The list lives in the page while it is open and is not saved or sent anywhere. Copy the text report if you want to keep it.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.