{
  "id": 5092433,
  "title": "What Was on This Machine? Answering the Blast Radius Question After a Laptop Compromise",
  "url": "https://urgent.news/2026/09/02/what-was-on-this-machine-answering-the-blast-radius-question-after-a",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-02T13:11:48.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/gitguardian/what-was-on-this-machine-answering-the-blast-radius-question-after-a-laptop-compromise-5hk"
  },
  "original_language": "en",
  "account": "The importance of knowing what was on a compromised laptop after a security breach cannot be overstated. Once a developer's laptop is compromised, an infostealer sends an alert, a device goes missing, or a dependency becomes malicious, the containment clock begins. While endpoint detection and response (EDR) and incident response tools are crucial in determining what happened on the machine, they cannot reveal what was exposed, such as valid credentials that an attacker can now use. This is known as the blast radius question, and most teams struggle to answer it quickly. Without a pre-incident inventory, security teams often rotate all credentials, wasting engineering time, or rotate too little, leaving live credentials exposed.\n\nThe scale of the problem is significant. GitGuardian's 2025 State of Secrets Sprawl report found 28.6 million new secrets leaked on public GitHub, a 34% increase year-over-year. This article explores why answering the blast radius question is challenging, what is needed to provide a comprehensive answer, and how a per-machine credential inventory can transform the uncertainty of \"we're not sure\" into a prioritized, actionable list. It also touches on the complementary role of ongoing remediation and prevention in shrinking the blast radius before the next incident occurs.\n\nThe moment a security team faces the question, \"What happens when an infostealer alert fires or one of your company's laptops is reported stolen?\" they must address what the attacker could potentially compromise and what needs to be rotated. Valid credentials factor into roughly 82% of intrusions, according to Verizon's Data Breaches Investigation Report (DBIR). Therefore, the speed and accuracy of answering these two questions significantly determine the incident's severity. The effectiveness of an organization's response largely depends on whether they recorded the machine's credentials before the incident. If not, security teams must manually reconstruct the data, a process that is slow, error-prone, and relies heavily on developers' memory.",
  "summary": "TL;DR: The containment clock starts immediately after a developer's laptop is compromised, an infostealer fires an alert, a device goes missing, or a dependency turns malicious. While important, EDR and incident response only tell you what happened on the machine, like which processes ran, what the attacker touched, and what was exfiltrated. They can't tell you what was exposed, such as valid…",
  "key_points": [
    "Answering blast radius question crucial after laptop compromise",
    "Valid credentials factor into 82% of intrusions",
    "Per-machine credential inventory transforms uncertainty into actionable list"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}