Blast radius is not a property of a breach.,it is a function of time. The same compromised credential produces a contained incident or a company-defining one depending entirely on how many seconds it held before something interrupted it. We all know this.