Turn BAS results into a prevented, detected and missed breakdown with a weighted control-efficacy score and drift check.
Prevention is worth roughly twice detection because a blocked action needs no analyst, and logging without alerting earns only token credit — it is useful in a post-incident investigation and useless during one. Critical scenarios that fail silently are deducted separately rather than just lowering an average, because burying them in a percentage is how a 70% score hides a total blind spot. The drift figure matters as much as the score: controls decay through configuration change even when nothing is attacked. BAS is the only routine way to find out that a control you are paying for stopped working three weeks ago, and drift is usually the finding rather than the initial score.
Breach and Attack Simulation Score
efficacy = preventedShare + 0.55×detectedShare + 0.20×loggedShare − criticalPenalty, so a fully prevented library scores 100, and detection is worth roughly half of prevention.
Control drift
drift = (currentScore − previousScore) × 30 ÷ daysSinceLastRun, expressed as points per month.
efficacy = preventedShare + 0.55×detectedShare + 0.20×loggedShare − criticalPenalty, so a fully prevented library scores 100, and detection is worth roughly half of prevention. Prevention is worth roughly twice detection because a blocked action needs no analyst, and logging without alerting earns only token credit — it is useful in a post-incident investigation and useless during one. Critical scenarios that fail silently are deducted separately rather than just lowering an average, because burying them in a percentage is how a 70% score hides a total blind spot. The drift figure matters as much as the score: controls decay through configuration change even when nothing is attacked.
BAS is the only routine way to find out that a control you are paying for stopped working three weeks ago, and drift is usually the finding rather than the initial score.
This calculator takes 7 inputs: Scenarios executed, Blocked outright, Not blocked but alerted, Logged with no alert, Critical scenarios neither blocked nor alerted, Score at the last run, Days since the last run. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because there is a real difference between an action you can reconstruct afterwards and one that left no trace. It is not defence, but it is the difference between a scoped investigation and guessing.
Continuously for critical controls and at least monthly for the broad library. Anything less and the drift figure covers so long a window that you cannot tie a regression to the change that caused it.