BlastMap: A Policy-Level Score for How Machine Identity Over-Privilege Amplifies Cloud AI Attack Vectors

Abstract

Cloud AI systems rely on machine identities to access storage, logging, computing, and other services. These identities are frequently granted more permissions than their workloads require. If a workload is compromised, an attacker may inherit those permissions, increasing the potential scope and impact of the intrusion. This paper presents BlastMap, a policy-level framework for analyzing machine identity over-privilege in cloud AI infrastructure. BlastMap uses an exposure score across eight documented dimensions and connects high-scoring permissions to relevant MITRE ATT&CK techniques and MITRE ATLAS tactics. The framework supports transparent comparison between over-privileged and least-privilege policies. In the reference analysis, policy minimization reduces the exposure score from 59/64 to 10/64. This represents a reduction in permitted policy-level exposure, not a demonstrated reduction in successful attacks. BlastMap is intended as a reproducible decision-support and governance tool.