Authentication Health Score Calculator

score = 0.25 × MFA + 0.15 × phishing resistance + 0.15 × SSO + 0.15 × policy + 0.12 × breach-free + 0.10 × non-stale + 0.08 × login success. Each input is normalised to 0–100, inverting the ones where lower is better, then combined with weights reflecting how much each control reduces account takeover. Multiplying each shortfall by its weight converts posture gaps into comparable points, so the biggest number is the work with the most risk reduction per unit of effort.

Identity is the control plane for everything else, and a single weighted score with an explicit next action is what turns a scattered list of identity metrics into a roadmap.

This calculator takes 7 inputs: Accounts with MFA, Accounts on phishing-resistant factors, Applications behind SSO, Password policy score, Accounts dormant over 90 days, Credentials found in breach corpora, Failed login rate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because they are not the same control. Adversary-in-the-middle phishing kits defeat SMS, TOTP and push approval by relaying them in real time, while origin-bound credentials such as passkeys cannot be replayed at all. An estate at 100 % MFA and 0 % phishing resistance is still losing accounts.

Yes. A dormant account has an unrotated password, no user watching it and often no MFA enrolment, so it is the preferred landing spot for a stuffing attack. Deprovisioning is also the cheapest item on this list.