Skip to content
ENExplore Calculators

Breach and Attack Simulation Score Calculator

Turn BAS results into a prevented, detected and missed breakdown with a weighted control-efficacy score and drift check.

About Breach and Attack Simulation Score Calculator

Prevention is worth roughly twice detection because a blocked action needs no analyst, and logging without alerting earns only token credit — it is useful in a post-incident investigation and useless during one. Critical scenarios that fail silently are deducted separately rather than just lowering an average, because burying them in a percentage is how a 70% score hides a total blind spot. The drift figure matters as much as the score: controls decay through configuration change even when nothing is attacked. BAS is the only routine way to find out that a control you are paying for stopped working three weeks ago, and drift is usually the finding rather than the initial score.

Formulas

Breach and Attack Simulation Score

efficacy = preventedShare + 0.55×detectedShare + 0.20×loggedShare − criticalPenalty, so a fully prevented library scores 100, and detection is worth roughly half of prevention.

preventedShare
Scenarios a control blocked outright
detectedShare
Scenarios that were not blocked but raised an alert
loggedShare
Scenarios recorded in logs with no alert — evidence only after the fact
criticalPenalty
1.5 × the share of critical scenarios that failed silently, capped at 30 points

Control drift

drift = (currentScore − previousScore) × 30 ÷ daysSinceLastRun, expressed as points per month.

drift
Rate at which validated efficacy is improving or decaying

Worked example

With the default values below, Breach and Attack Simulation Score Calculator returns Control Efficacy Score of 69.5. Change any input above and every figure here is recalculated in your browser.

Inputs used

Scenarios executedaccepts 1–100,000 scenarios
500 scenarios
Blocked outrightaccepts 0–100,000 scenarios
285 scenarios
Not blocked but alertedaccepts 0–100,000 scenarios
130 scenarios
Logged with no alertaccepts 0–100,000 scenarios
45 scenarios
Critical scenarios neither blocked nor alertedaccepts 0–100,000 scenarios
12 scenarios
Score at the last runaccepts 0–100 / 100
68 / 100
Days since the last runaccepts 1–3,650 days
30 days

Results

Control Efficacy Score
69.5 / 100
Prevention Rate
57.0%
Detection Rate
83.0%
Silent Failure Rate
12.5%
Score Drift per Month
1.50 points/month
Efficacy Rating
C — Fair
Priority Action
Close the critical silent failures first — those are scenarios you would never know happened

Step by step

  1. 1Values used
  2. 2Breach and Attack Simulation Score
  3. 3Control drift
  4. 4Control Efficacy Score= 69.5 / 100
  5. 5Prevention Rate= 57.0
  6. 6Detection Rate= 83.0
  7. 7Silent Failure Rate= 12.5
  8. 8Score Drift per Month= 1.50 points/month
  9. 9Efficacy Rating= C — Fair

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Breach and Attack Simulation Score calculated?

efficacy = preventedShare + 0.55×detectedShare + 0.20×loggedShare − criticalPenalty, so a fully prevented library scores 100, and detection is worth roughly half of prevention. Prevention is worth roughly twice detection because a blocked action needs no analyst, and logging without alerting earns only token credit — it is useful in a post-incident investigation and useless during one. Critical scenarios that fail silently are deducted separately rather than just lowering an average, because burying them in a percentage is how a 70% score hides a total blind spot. The drift figure matters as much as the score: controls decay through configuration change even when nothing is attacked.

Why does Breach and Attack Simulation Score matter?

BAS is the only routine way to find out that a control you are paying for stopped working three weeks ago, and drift is usually the finding rather than the initial score.

What values do I need to enter?

This calculator takes 7 inputs: Scenarios executed, Blocked outright, Not blocked but alerted, Logged with no alert, Critical scenarios neither blocked nor alerted, Score at the last run, Days since the last run. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does logged-only score at all?

Because there is a real difference between an action you can reconstruct afterwards and one that left no trace. It is not defence, but it is the difference between a scoped investigation and guessing.

How often should simulations run?

Continuously for critical controls and at least monthly for the broad library. Anything less and the drift figure covers so long a window that you cannot tie a regression to the change that caused it.

Related Calculators

Breach and Attack Simulation Score Calculator | Calcrivo