# Access Concentration Risk
URL: https://docs.autociso.io/console/ciso-reports/access-concentration/
Description: This report identifies employees who have access to an unusually large number of assets.

*This is the help text the console shows in the help panel on this page.*

This report identifies employees who have access to an unusually large number of assets. High access concentration increases the blast radius of a compromised account — if that person is phished, the attacker gains a wide foothold. Employees with TERMINATED status are not listed here; see [Offboarding Violations](https://docs.autociso.io/console/ciso-reports/offboarding-violations/) for them.

### Key Metrics
- **Total Employees**: Employees who currently have access to at least one asset.
- **High Blast Radius (≥5 assets)**: Employees with access to 5 or more distinct assets.
- **Avg Assets per Employee**: The organizational baseline for normal access breadth.
- **Max Access Count**: The single employee with the broadest access scope.

### Data Table
Employees are ranked by **Assets Accessed**. That count is color-coded: blue (1–2 assets), amber (3–4), red (5 or more). **Avg Risk** and **Total Risk** show the risk scores of the employee's access grants. The **Top Assets** column lists up to three of the assets they can reach; hover to see the full list.

### Actions
Use this report to identify accounts that should undergo [immediate access review](https://docs.autociso.io/console/iso/access-reviews/). Search the table, sort any column, and export with **CSV** or **PDF** for CISO briefings.

### When To Use
- Before an external audit to proactively reduce blast radius.
- [After a role change](https://docs.autociso.io/console/ciso-reports/high-risk-lifecycle/) to verify access was trimmed appropriately.
- As a quarterly hygiene check for [privileged users](https://docs.autociso.io/console/ciso-reports/privileged-access-delta/).