Blast Radius · node9 documentation
Blast Radius
What an agent on this machine can reach right now, as it is configured today.
Map it
node9 blastWalks what is actually present on the machine, not what a policy says should be, and reports the reach an agent has from here.
Rules describe intent. This describes exposure. The two diverge in the ordinary way: a cloud profile that was added for one afternoon, a token left in an environment file, a database the agent can still reach because nobody revoked it. None of that is a rule failing. It is reach nobody revisited.
Reading it next to a scan
node9 blast # what could be reached node9 scan # what was actually attemptedReach that was never touched is the cheapest thing to remove, because removing it costs nobody anything.