Blast Radius: What Was Accessed or Sent

Blast radius: what was accessed or sent

When an account is compromised or an attacker gets access, one of the first questions you need to answer is: what did they actually touch? Petra's blast radius view answers that by showing you which emails were read, sent, or deleted, and which files or documents were accessed, modified, or shared. This article explains what blast radius means and how to use it.

What blast radius means

"Blast radius" in Petra refers to the scope of impact of an incident—the set of resources (emails, files, etc.) that the affected user or attacker actually accessed or used during the incident. Instead of guessing what might have been exposed, you get a concrete list or summary: these many emails were read, these were sent from the account, these were deleted, and these documents were opened or modified. That helps you assess real impact, decide what to remediate (e.g., revoke sharing, notify recipients), and report accurately to the business or customer.

What you'll see

On the incident detail view, the blast radius is often shown in tables or sections: one for email (Exchange) and one for files (e.g., SharePoint). You might see counts (e.g., "12 emails accessed, 3 sent") and optionally a list or breakdown of the items. You may also see time-based metrics such as how long the attacker had access and how quickly the incident was detected and contained. These numbers are useful for incident reports and for understanding whether the compromise was brief or prolonged.

Using blast radius in your response

Use the blast radius to prioritize: if many sensitive emails or high-value documents were accessed, you may need to notify more people or take additional steps (e.g., resetting passwords for recipients of forwarded emails). If the blast radius is small or the content is low sensitivity, your response might be more contained. You can also use the blast radius to communicate with the affected user or their manager—"here's what was accessed"—and to document the incident for compliance or post-incident review. In short, blast radius turns "we had an incident" into "here’s exactly what was impacted," so you can respond and report with confidence.