Identity Blast Radius Estimator
An account is compromised. Before you start resetting things, work out what it could reach and what to cut off first. Describe the account and get its likely reach, a containment plan in priority order with time estimates, and a severity hint. Runs in your browser; no names or secrets needed.
The compromised account
Treat as your top severity: incident lead and executive sponsor now, containment in minutes, legal and insurer informed today.
Driven by: Admin · Global / tenant administrator · Mail administrator · Standing privileged access · Long session lifetime
Map this to your own severity scale. A hint from simple rules, not a verdict.
Likely reach
What the attacker could have touched with this account. Scope your investigation here first.
- LikelyThe whole identity tenant
Can create users, admins, app registrations and app credentials, change conditional access and add federated domains — persistence that survives password resets.
- LikelyOwn mailbox, files and chat
The first thing attackers read: invoices, password-reset mails, shared documents and conversations to impersonate.
- LikelyEvery mailbox in the organisation
Mail admins can search and export any mailbox and create mail-flow rules that copy or redirect mail.
- Likely22 SSO-connected apps
Each app can be opened without a new sign-in while the session is valid, and this session lifetime is long. Apps that keep their own sessions stay open after you revoke the identity provider session.
- Likely3 third-party OAuth grants
Refresh tokens held by these apps keep working after a password reset; at least one has broad mail or file access.
Containment, in priority order
The “Now” steps take roughly 24 min–1.3 h of hands-on time; the whole list 3.6 h–13.3 h. Run them in parallel where you have people.
- 1NowExport logs before you change anything5 min–15 min
Export identity-provider sign-in and audit logs for the account (at least 30 days if available) to storage you control. Keep it to minutes; do not delay containment for a full investigation.
- 2NowConfirm you have a clean admin path5 min–15 min
Make sure a second Global admin or break-glass account works and is not the compromised one. You need admin rights to contain an admin.
- 3NowBlock sign-in, then reset the password2 min–5 min
For privileged accounts, block first so nothing new can be issued, then reset.
- 4NowRevoke sessions and refresh tokens2 min–10 min
Revoke all sessions in the identity provider. Access tokens already issued can stay valid until they expire, typically up to about an hour, unless apps support continuous access evaluation.
- 5NowRemove MFA methods and re-register under a verified check10 min–30 min
Delete every method added in the attack window (and all methods if unsure). Re-register by call-back to a number on file or in person.
- 6Next hourSign out of SSO apps that keep their own sessions (22 connected)30 min–1.5 h
Prioritise apps holding money, personal data or admin functions. Many apps ignore identity-provider revocation until their own session expires.
- 7Next hourRevoke OAuth consents and app passwords (3 grants)10 min–30 min
Remove grants made in the attack window first, starting with those that can read mail or files. OAuth refresh tokens survive password resets.
- 8Next hourRotate keys the account held or could read30 min–3 h
Cloud access keys, personal access tokens, SSH keys and secrets in vaults the account could open. Safe order: new, verify, update, then revoke.
- 9Next hourRemove mailbox persistence15 min–30 min
Inbox rules, external forwarding, delegates and send-as rights. Export each rule before deleting it.
- 10TodaySweep the tenant for persistence1 h–4 h
New admins and eligible roles, new apps and new credentials on existing apps, conditional access changes, new domains and federation settings, registered devices, guest invitations.
- 11TodayHunt for other victims of the same campaign30 min–2 h
Search mail for the same lure and sign-in logs for the attacker's IP addresses and user agent.
- 12TodayRe-enrol with phishing-resistant MFA15 min–30 min
Security key, passkey or certificate-based sign-in for this account before it is fully restored — especially if it holds privileged roles.
What this tool does
- Describe the compromised account — type, roles and groups, SSO apps, OAuth grants, privileged access model, MFA type, session lifetime, time since compromise and how it happened. You never enter a username or secret.
- Get the likely reach: which systems the attacker could have touched, marked Likely or Possible, with the reason for each.
- Get containment actions in priority order (Now, Next hour, Today), each with a rough time estimate, including the steps a password reset misses: session and token revocation, MFA methods, OAuth grants, keys and persistence.
- A severity hint shows what drives the rating so you can map it to your own scale. Copy the whole plan as plain text into your incident channel or ticket.
- The rules are simple and visible. Treat the output as a fast first pass, not a measurement.
Contain everywhere at once
The most common mistake after an account takeover is partial containment: the password is reset, but the stolen session, an OAuth grant, an attacker-added MFA method or a new app credential keeps working. The attacker notices, and digs in. The order here is deliberate — preserve a little evidence, make sure you have a clean admin path, cut access everywhere, then sweep for persistence before giving the account back. Work through the full sequence with the Identity Compromise Response Checklist.
Frequently asked questions
What is the blast radius of a compromised account?
Everything the attacker could reach with it while they had access: the account's own data, every app it can open through single sign-on, third-party apps it consented to, systems its roles control, and other accounts it can reset or impersonate. The blast radius sets the scope of the investigation and the order of containment.
Why is revoking sessions more important than resetting the password?
Modern phishing kits and infostealers steal the session after MFA, not just the password. A stolen session or refresh token keeps working after a password change until it is revoked. OAuth app grants also hold their own refresh tokens. Reset the password, but revoke sessions, remove attacker-added MFA methods and revoke grants as well.
How is the severity hint calculated?
It adds simple weights: the account type, privileged roles (tenant or domain admin weigh the most), standing privilege, long sessions, many SSO apps, broad OAuth grants, how long the attacker has had and whether an infostealer is involved. The total maps to Low, Medium, High or Critical, and the main drivers are listed. It is a hint for triage, not a replacement for your severity matrix.
Are the time estimates realistic?
They are typical hands-on ranges for a team that has the access and runbooks ready. Your first incident on a platform will take longer. Use them to plan who does what in parallel, not as a promise.
Is anything I enter sent anywhere?
No. The estimator runs entirely in your browser and only asks about the shape of the account, never names, usernames or secrets.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.