Why identity-local signals and topology signals are two layers of the same blast...
Why identity-local signals and topology signals are two layers of the same blast radius
The credential with the widest blast radius sometimes has no secret to flag. See how GitGuardian and Anyshift rank risk by what actually breaks.
By Louis Fradin • 23 Jul 2026 • 7 min read
A leaked credential is also a topology problem
A leaked credential creates risk beyond the identity itself. Its real impact depends on the services and resources connected to what that credential can access.
A secret scanner tells you a key leaked. It can't tell you how much breaks if it's misused. Score your agent key's blast radius…
You cannot control every exploit path, but you can control what is stolen.
When a CI pipeline failed at 02:13 AM on March 3, we discovered that 412 distinct API tokens had been...
In security, the most consequential failures rarely announce themselves.
Threat-intel reports from recent years document campaigns in which attackers obtain AWS IAM...
Discovery finds it. Governance restricts it. Detection watches it. Response contains it. Every layer...
