Skip to content
ENExplore Calculators

Asset Exposure Calculator

Score how exposed one asset is: reachability, open services, admin access, authentication strength, segmentation and its worst open finding.

About Asset Exposure Calculator

Reachability dominates deliberately: an internet-addressable asset starts at 40 points because every other weakness is only reachable through it. Vulnerability count contributes less than the single worst EPSS score, because one probable exploit matters more than a dozen theoretical ones, and a WAF earns a fixed 8-point credit rather than a proportional one — it filters traffic, it does not remove the exposure. Two assets with identical vulnerability lists can differ by fifty points of exposure, and that difference is what decides which one you patch tonight.

Formulas

Asset Exposure

Exposure = reachability (40 internet / 12 internal, + 2.5 per service up to 15, + 12 for an exposed management interface) + authentication points + segmentation points + vulnerability points (0.8 each up to 12, plus 0.15 × highest EPSS up to 15) − 8 if a WAF or IPS is in front.

reachability
Whether and how widely the asset can be addressed
auth points
0 phishing-resistant MFA … 12 anonymous
seg points
0 micro-segmented … 12 flat network
EPSS
Highest exploitation probability among open findings

Exposure bands

Bands: 0–19 Informational, 20–39 Low, 40–59 Medium, 60–79 High, 80+ Critical exposure.

Worked example

With the default values below, Asset Exposure Calculator returns Exposure Score of 71.9. Change any input above and every figure here is recalculated in your browser.

Inputs used

Reachable from the internet
Yes
Listening services reachableaccepts 0–500 services
6 services
Management interface reachable from a user network
No
Authentication on exposed servicesone of Phishing-resistant MFA and mTLS — 0 pts, MFA for all users — 4 pts, Password only — 8 pts, Anonymous or shared credentials — 12 pts
Password only — 8 pts
Network segmentation around the assetone of Micro-segmented, default deny — 0 pts, Own VLAN with ACLs — 4 pts, Shared server VLAN — 8 pts, Flat network — 12 pts
Own VLAN with ACLs — 4 pts
Open findings on the assetaccepts 0–10,000 findings
12 findings
Highest EPSS score among themaccepts 0–100 %
22 %
WAF, reverse proxy or IPS in front
Yes

Results

Exposure Score
71.9 / 100
Exposure Band
High
Reachability Contribution
55.0 pts
Vulnerability Contribution
12.9 pts
Largest Single Driver
Internet reachability — 40 of the points come from being publicly addressable
Fastest Reduction
Close or firewall the services that are not required

Step by step

  1. 1Values used
  2. 2Asset Exposure
  3. 3Exposure bands
  4. 4Exposure Score= 71.9 / 100
  5. 5Exposure Band= High
  6. 6Reachability Contribution= 55.0 pts
  7. 7Vulnerability Contribution= 12.9 pts
  8. 8Largest Single Driver= Internet reachability — 40 of the points come from being publicly addressable
  9. 9Fastest Reduction= Close or firewall the services that are not required

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Asset Exposure calculated?

Exposure = reachability (40 internet / 12 internal, + 2.5 per service up to 15, + 12 for an exposed management interface) + authentication points + segmentation points + vulnerability points (0.8 each up to 12, plus 0.15 × highest EPSS up to 15) − 8 if a WAF or IPS is in front. Reachability dominates deliberately: an internet-addressable asset starts at 40 points because every other weakness is only reachable through it. Vulnerability count contributes less than the single worst EPSS score, because one probable exploit matters more than a dozen theoretical ones, and a WAF earns a fixed 8-point credit rather than a proportional one — it filters traffic, it does not remove the exposure.

Why does Asset Exposure matter?

Two assets with identical vulnerability lists can differ by fifty points of exposure, and that difference is what decides which one you patch tonight.

What values do I need to enter?

This calculator takes 8 inputs: Reachable from the internet, Listening services reachable, Management interface reachable from a user network, Authentication on exposed services, Network segmentation around the asset, Open findings on the asset, Highest EPSS score among them, WAF, reverse proxy or IPS in front. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is this the same as an attack surface score?

No. Attack surface counts the whole estate's entry points; this scores one asset's reachability and weakness. Use the attack surface calculator for the programme view and this one for the queue-ordering decision.

Why does an exposed management interface cost so much?

Because management planes concentrate privilege — a reachable SSH, RDP, IPMI or hypervisor console turns any credential compromise into full control of the asset. It is consistently the highest-value single reduction available.

Related Calculators

Asset Exposure Calculator | Calcrivo