The question it answers
Blast radius is the reach of the damage if a specific asset is compromised. Not how much that asset is worth, but what it touches: which systems it reaches, which credentials it holds, where it can move.
It is a question about consequence, and it changes queue order more than any severity score.
Why it reorders the queue
Two flaws with the same CVSS score can carry consequences separated by orders of magnitude.
One sits on an isolated marketing site, no database, no integration, hosted outside the main environment. Compromising it gives the adversary a page to deface.
The other sits on an application server that talks to the identity directory and holds a service credential in its config file. Compromising it gives the start of a path inward.
The scanner assigns both the same score, because the score describes the flaw and not the place it lives in.
How to estimate without mapping everything
A complete path survey requires internal visibility most organizations lack. Three cheap questions cover much of the value.
Which credentials does this asset hold or use? A service credential in a config file is the most common blast-radius multiplier.
Which other systems does it talk to? API integrations and database connections define where the compromise extends with no extra effort.
Does it share identity with the main environment? A staging environment authenticating against the same production directory has production blast radius, and is almost always treated as if it did not.
The most common misreading
Confusing blast radius with asset criticality.
Criticality describes the value of what sits there. Blast radius describes the reach from there. The lowest-value asset in the organization can carry the largest radius, and that is usually exactly the case: a forgotten server, holding no data, keeping a service credential that still works.
Where it fits in prioritization
Prioritizing by severity orders by how bad the flaw is in theory. Prioritizing by blast radius orders by how far the adversary gets if they pass through there.
The combination that works is using exploitability validation to learn what is genuinely reachable and blast radius to order what remains. The first cuts what is theoretical; the second decides what to attack first among what is left.