Attack Surface Calculator

Index = 1 × public IPs + 1.5 × reachable services + 4 × web apps + 0.5 × API endpoints + 0.05 × remote users + 3 × integrations + 2.5 × cloud accounts. Normalised = min(100, 10 × log₂(index)). The weights encode how much attacker effort each entry point saves: a web application is worth four points because it brings its own authentication, session handling and dependency tree, while an API endpoint is worth half a point because dozens usually sit behind one authentication layer. Normalising logarithmically keeps a 40-host estate and a 4,000-host estate on the same 0–100 scale.

Attack surface is the only vulnerability metric you can reduce without patching anything, and decommissioning is cheaper than remediation every single time.

This calculator takes 7 inputs: Public IP addresses, Reachable listening services, Internet-facing web applications, Published API endpoints, Remote-access users, Third-party integrations with data access, Cloud accounts or subscriptions. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because credential phishing and compromised endpoints are the most common initial-access vectors, so each remote user is a reachable entry point. The weight is small per user precisely because MFA and device posture checks scale across all of them at once.

Decommission unused services, consolidate public IPs behind fewer ingress points, retire shadow applications and cut third-party integrations that no longer have a business owner. The largest-contributor output tells you which of those gives the biggest single reduction.