Skip to content
ENExplore Calculators

Authentication Health Score Calculator

Score the whole authentication estate — MFA, phishing resistance, SSO, policy, stale accounts — and get the top gap.

About Authentication Health Score Calculator

Each input is normalised to 0–100, inverting the ones where lower is better, then combined with weights reflecting how much each control reduces account takeover. Multiplying each shortfall by its weight converts posture gaps into comparable points, so the biggest number is the work with the most risk reduction per unit of effort. Identity is the control plane for everything else, and a single weighted score with an explicit next action is what turns a scattered list of identity metrics into a roadmap.

Formulas

Authentication Health Score

score = 0.25 × MFA + 0.15 × phishing resistance + 0.15 × SSO + 0.15 × policy + 0.12 × breach-free + 0.10 × non-stale + 0.08 × login success.

phishing resistance
Share of accounts on origin-bound credentials
breach-free
100 − 8 × the percentage of credentials found in breach corpora

Gap analysis

gap in points = weight × (100 − component score); the largest gap is the highest-value next action.

Worked example

With the default values below, Authentication Health Score Calculator returns Authentication Health Score of 69.6. Change any input above and every figure here is recalculated in your browser.

Inputs used

Accounts with MFAaccepts 0–100 %
82 %
Accounts on phishing-resistant factorsaccepts 0–100 %
30 %
Applications behind SSOaccepts 0–100 %
75 %
Password policy scoreaccepts 0–100 / 100
70 / 100
Accounts dormant over 90 daysaccepts 0–100 %
6 %
Credentials found in breach corporaaccepts 0–100 %
3 %
Failed login rateaccepts 0–100 %
4 %

Results

Authentication Health Score
69.6 / 100
Grade
C — Fair
Highest-Value Next Action
Roll out phishing-resistant authenticators — FIDO2 security keys or passkeys
Points Locked in That Gap
10.50 points
Total Points Available
30.4 points

Step by step

  1. 1Values used
  2. 2Authentication Health Score
  3. 3Gap analysis
  4. 4Authentication Health Score= 69.6 / 100
  5. 5Grade= C — Fair
  6. 6Highest-Value Next Action= Roll out phishing-resistant authenticators — FIDO2 security keys or passkeys
  7. 7Points Locked in That Gap= 10.50 points
  8. 8Total Points Available= 30.4 points

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Authentication Health Score calculated?

score = 0.25 × MFA + 0.15 × phishing resistance + 0.15 × SSO + 0.15 × policy + 0.12 × breach-free + 0.10 × non-stale + 0.08 × login success. Each input is normalised to 0–100, inverting the ones where lower is better, then combined with weights reflecting how much each control reduces account takeover. Multiplying each shortfall by its weight converts posture gaps into comparable points, so the biggest number is the work with the most risk reduction per unit of effort.

Why does Authentication Health Score matter?

Identity is the control plane for everything else, and a single weighted score with an explicit next action is what turns a scattered list of identity metrics into a roadmap.

What values do I need to enter?

This calculator takes 7 inputs: Accounts with MFA, Accounts on phishing-resistant factors, Applications behind SSO, Password policy score, Accounts dormant over 90 days, Credentials found in breach corpora, Failed login rate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is phishing resistance weighted separately from MFA?

Because they are not the same control. Adversary-in-the-middle phishing kits defeat SMS, TOTP and push approval by relaying them in real time, while origin-bound credentials such as passkeys cannot be replayed at all. An estate at 100 % MFA and 0 % phishing resistance is still losing accounts.

Do stale accounts really matter that much?

Yes. A dormant account has an unrotated password, no user watching it and often no MFA enrolment, so it is the preferred landing spot for a stuffing attack. Deprovisioning is also the cheapest item on this list.

Related Calculators

Authentication Health Score Calculator | Calcrivo