Calculate Compromised Identity Blast Radius in Seconds

Outcome

When a security alert implicates a user account, the most urgent question is: what can this identity reach? Answering it determines the scope of containment, the urgency of notification, and whether the investigation needs to expand. Trustfusion answers that question — across every connected application, including local accounts outside IDP scope and access inherited through groups and roles — in under 60 seconds, from a single query in plain English.

The blast radius assessment that previously consumed the first hour of an identity incident response is completed before the first response call ends. The time saved is time spent on containment instead of archaeology.

What makes this hard today: Every application holds a slice of the access picture. The IDP shows groups and policies. Salesforce shows profiles. GitHub shows repositories. Snowflake shows roles. None of them shows the whole thing — and none of them shows local accounts created outside the IDP provisioning workflow, or access inherited through three layers of group nesting. Building the picture manually takes 60 to 180 minutes under active incident pressure.

‍

Why this is hard without Oleria

Answering "what does this identity have access to?" requires entitlement data from every application the identity touches — each with its own admin console, its own export format, and its own access model. A typical SaaS stack of ten applications means ten separate logins, ten exports, and a manual reconciliation across usernames that are formatted differently in every system. In most organizations this process takes one to three hours. Every minute of that reconstruction is time the attacker is still inside the perimeter with unconstrained access.

· IDP visibility is incomplete by design. The IDP manages accounts it provisioned. Local SaaS accounts, cloud IAM users created directly, and accounts provisioned by application admins outside the IDP workflow are invisible to IDP-centric access views — even though they carry real entitlements to real systems.

· Indirect access paths are invisible to flat exports. An identity that reaches a sensitive Snowflake schema through a role assigned to an Entra ID group they belong to does not appear in a direct-permission export of that schema. The true blast radius is systematically underestimated by any tool that reports only direct permission assignments.

· Data sensitivity is not connected to the access picture. Even when entitlement data is assembled, it does not indicate which resources carry PII, PHI, financial data, or source code. Determining whether the compromised identity had access to regulated data requires a separate lookup — another delay in the first hour.

· No pre-assembled cross-system view exists. There is no native tool in a standard enterprise stack that holds the correlated, cross-system access picture for every identity at all times. Without Oleria, the blast radius picture has to be assembled from scratch each time it is needed — which means it is never assembled until it is urgently needed.

‍

What Oleria delivers

Trustfusion maintains the complete, correlated access picture for every identity at all times — so that when an incident is declared, the blast radius is a query away, not a reconstruction project.

Identity 360 View: complete cross-system access in one screen

For any identity, the Identity 360 View surfaces every application account across every connected system — IDP-managed and local — with every role, permission, and group membership, resolved through all indirect inheritance paths. Five applications, two local credentials, three layers of group nesting: all visible in a single result, in under 60 seconds.

Sensitive resource access flagged by data classification.

The Access Graph joins entitlement data to data classification signals from Microsoft Purview, Google Workspace classification, and administrator-applied tags. Resources carrying PII, PHI, financial data, or source code are flagged in the blast radius view — so investigators know immediately whether the compromise potentially reached regulated data.

Privileged access highlighted across all systems.

Privileged roles held by the implicated identity — in any connected application — are surfaced with their privilege tier. An identity that is a standard Okta user but holds ACCOUNTADMIN in Snowflake and AdministratorAccess in AWS appears with those escalations clearly visible alongside their standard entitlements.

Local account and inherited access fully resolved

Accounts the identity holds outside IDP management — local SaaS credentials, direct cloud IAM users — are included in the blast radius view. Access inherited through group membership and role hierarchies is resolved to its full effective depth. Nothing is hidden behind indirect paths or out-of-IDP-scope accounts.

Pre-incident authentication posture.

MFA enrollment status, authentication method strength, SSO federation per application, and any open authentication posture findings for the implicated identity are surfaced alongside the entitlement data — giving investigators immediate context on whether the account had adequate authentication controls at the time of compromise.

How it works

Connect Oleria's read-only connectors integrate with IDPs, SaaS applications, cloud IAM, and HR systems — no agents, no write access. The Access Graph is continuously updated as the environment changes. When an incident is declared, the cross-system access picture is already assembled and current.

Ask The analyst types the implicated identity's name or email into Trustfusion. Oleria queries the Access Graph, resolves every account, entitlement, and indirect access path across every connected system, and joins data classification signals to flag sensitive resources.

Review The Identity 360 View returns the complete blast radius: every application account, every role and permission (direct and inherited), privilege tier per system, sensitive resource access flagged by classification, authentication posture, and open posture findings — all in one screen. No pivoting between admin consoles.

Act From the same screen: suspend the identity in the IDP, revoke specific entitlements, export the blast radius inventory for regulatory notification, or open a pre-populated incident ticket. Every action is logged with timestamp, analyst identity, and outcome in the Trustfusion audit trail.

‍

What good looks like

▸ Time to blast radius assessment: 60–180 minutes of multi-system export reconciliation → under 60 seconds from identity name to complete cross-system access footprint, including local accounts, indirect inheritance, and sensitive resource classification.

▸ Blast radius completeness: IDP-visible entitlements only (systematically incomplete) → full picture including local SaaS accounts, cloud IAM users created outside IDP, and all access inherited through group and role hierarchies.

▸ Regulated data exposure assessment: Manual lookup across each application's data catalog (additional 30–60 minutes) → integrated into the blast radius view, flagged by classification label, available in the same 60-second result.

▸ Containment scope accuracy: Based on approximate IDP-visible access (local accounts and inherited access missed) → based on complete cross-system access scope, confirmed in the Access Graph after revocation.

Frequently Asked Questions

How long does it take Oleria to show the full access footprint of a compromised identity?

Under 60 seconds from entering the identity name or email into Trustfusion. The Access Graph is continuously maintained — there is no additional data collection step when an incident is declared. The cross-system correlation, indirect path resolution, and data classification joins are already in place. The time from "we have a potentially compromised account" to "we have the complete blast radius" is the time it takes to open the Identity 360 View.

Does Oleria cover accounts the compromised identity holds outside our IDP?

Yes. Trustfusion inventories accounts in every connected application regardless of whether they are IDP-managed or created locally. A Salesforce account created directly by a Salesforce admin, a GitHub account set up outside the IDP provisioning workflow, or a Snowflake account with local credentials — all are in the Access Graph with their entitlement data, privilege tier, and authentication pathway. These are often the highest-risk accounts in a breach scenario because they are outside centralized MFA and deprovisioning workflows.

Can Oleria tell me if the compromised identity had access to PII, PHI, or financial data?

Yes. The Access Graph joins entitlement data to data classification signals from Microsoft Purview sensitivity labels, Google Workspace classification, and administrator-applied tags in Trustfusion. Resources carrying regulated or sensitive data classifications are flagged in the blast radius view. Investigators know within the first 60-second result whether the compromise potentially reached data that triggers notification obligations.

How does Oleria handle access inherited through group membership or role hierarchies?

The Access Graph resolves all access paths to full effective depth — not just direct assignments. An identity that reaches a Snowflake schema through a role assigned to an Entra ID group they belong to appears in the blast radius for that schema, with the full derivation path shown. This is a systematic gap in IDP admin consoles and most access review tools, which report only direct permission assignments.

Is Oleria useful for blast radius assessment if we already have a SIEM?

Yes — Trustfusion and the SIEM serve complementary roles. The SIEM detects behavioral anomalies and generates the alert. Trustfusion provides the identity and access context that makes the alert actionable: what the implicated identity had access to, whether that access included regulated data, and what the full scope of potential compromise is. Investigators use both — the SIEM identifies the signal; Trustfusion answers the access questions the signal raises.

Know the full blast radius of any compromised identity in seconds, before you take one action