Asset Exposure Calculator

Exposure = reachability (40 internet / 12 internal, + 2.5 per service up to 15, + 12 for an exposed management interface) + authentication points + segmentation points + vulnerability points (0.8 each up to 12, plus 0.15 × highest EPSS up to 15) − 8 if a WAF or IPS is in front. Reachability dominates deliberately: an internet-addressable asset starts at 40 points because every other weakness is only reachable through it. Vulnerability count contributes less than the single worst EPSS score, because one probable exploit matters more than a dozen theoretical ones, and a WAF earns a fixed 8-point credit rather than a proportional one — it filters traffic, it does not remove the exposure.

Two assets with identical vulnerability lists can differ by fifty points of exposure, and that difference is what decides which one you patch tonight.

This calculator takes 8 inputs: Reachable from the internet, Listening services reachable, Management interface reachable from a user network, Authentication on exposed services, Network segmentation around the asset, Open findings on the asset, Highest EPSS score among them, WAF, reverse proxy or IPS in front. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

No. Attack surface counts the whole estate's entry points; this scores one asset's reachability and weakness. Use the attack surface calculator for the programme view and this one for the queue-ordering decision.

Because management planes concentrate privilege — a reachable SSH, RDP, IPMI or hypervisor console turns any credential compromise into full control of the asset. It is consistently the highest-value single reduction available.