Skip to content
ENExplore Calculators

Attack Surface Calculator

Index your external attack surface across hosts, services, web apps, API endpoints, remote users, integrations and cloud accounts.

About Attack Surface Calculator

The weights encode how much attacker effort each entry point saves: a web application is worth four points because it brings its own authentication, session handling and dependency tree, while an API endpoint is worth half a point because dozens usually sit behind one authentication layer. Normalising logarithmically keeps a 40-host estate and a 4,000-host estate on the same 0–100 scale. Attack surface is the only vulnerability metric you can reduce without patching anything, and decommissioning is cheaper than remediation every single time.

Formulas

Attack Surface

Index = 1 × public IPs + 1.5 × reachable services + 4 × web apps + 0.5 × API endpoints + 0.05 × remote users + 3 × integrations + 2.5 × cloud accounts. Normalised = min(100, 10 × log₂(index)).

1.5 per service
Each listening port is a distinct entry point
4 per web app
Applications carry their own logic, session and dependency risk
0.05 per user
Human surface: credential phishing and device compromise
log₂
Logarithmic normalisation so the index stays readable across estate sizes

Service concentration

Services per public IP shows how much you have stacked behind each address — high values mean one firewall mistake exposes many services at once.

Worked example

With the default values below, Attack Surface Calculator returns Attack Surface Index of 538.5. Change any input above and every figure here is recalculated in your browser.

Inputs used

Public IP addressesaccepts 0–1,000,000 addresses
42 addresses
Reachable listening servicesaccepts 0–1,000,000 services
118 services
Internet-facing web applicationsaccepts 0–100,000 apps
14 apps
Published API endpointsaccepts 0–1,000,000 endpoints
260 endpoints
Remote-access usersaccepts 0–10,000,000 users
900 users
Third-party integrations with data accessaccepts 0–100,000 integrations
22 integrations
Cloud accounts or subscriptionsaccepts 0–100,000 accounts
9 accounts

Results

Attack Surface Index
538.5 pts
Normalised Score
90.7 / 100
Surface Band
Critical
Largest Contributor
Listening services — 177 points from 118 reachable services
Services per Public IP
2.81
Points Removable by Halving It
88.5 pts

Step by step

  1. 1Values used
  2. 2Attack Surface
  3. 3Service concentration
  4. 4Attack Surface Index= 538.5 pts
  5. 5Normalised Score= 90.7 / 100
  6. 6Surface Band= Critical
  7. 7Largest Contributor= Listening services — 177 points from 118 reachable services
  8. 8Services per Public IP= 2.81
  9. 9Points Removable by Halving It= 88.5 pts

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Attack Surface calculated?

Index = 1 × public IPs + 1.5 × reachable services + 4 × web apps + 0.5 × API endpoints + 0.05 × remote users + 3 × integrations + 2.5 × cloud accounts. Normalised = min(100, 10 × log₂(index)). The weights encode how much attacker effort each entry point saves: a web application is worth four points because it brings its own authentication, session handling and dependency tree, while an API endpoint is worth half a point because dozens usually sit behind one authentication layer. Normalising logarithmically keeps a 40-host estate and a 4,000-host estate on the same 0–100 scale.

Why does Attack Surface matter?

Attack surface is the only vulnerability metric you can reduce without patching anything, and decommissioning is cheaper than remediation every single time.

What values do I need to enter?

This calculator takes 7 inputs: Public IP addresses, Reachable listening services, Internet-facing web applications, Published API endpoints, Remote-access users, Third-party integrations with data access, Cloud accounts or subscriptions. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why do remote users count as attack surface?

Because credential phishing and compromised endpoints are the most common initial-access vectors, so each remote user is a reachable entry point. The weight is small per user precisely because MFA and device posture checks scale across all of them at once.

How do I actually reduce the index?

Decommission unused services, consolidate public IPs behind fewer ingress points, retire shadow applications and cut third-party integrations that no longer have a business owner. The largest-contributor output tells you which of those gives the biggest single reduction.

Related Calculators

Attack Surface Calculator – Calculate Attack Surface Index