Breach and Attack Simulation Score Calculator

efficacy = preventedShare + 0.55×detectedShare + 0.20×loggedShare − criticalPenalty, so a fully prevented library scores 100, and detection is worth roughly half of prevention. Prevention is worth roughly twice detection because a blocked action needs no analyst, and logging without alerting earns only token credit — it is useful in a post-incident investigation and useless during one. Critical scenarios that fail silently are deducted separately rather than just lowering an average, because burying them in a percentage is how a 70% score hides a total blind spot. The drift figure matters as much as the score: controls decay through configuration change even when nothing is attacked.

BAS is the only routine way to find out that a control you are paying for stopped working three weeks ago, and drift is usually the finding rather than the initial score.

This calculator takes 7 inputs: Scenarios executed, Blocked outright, Not blocked but alerted, Logged with no alert, Critical scenarios neither blocked nor alerted, Score at the last run, Days since the last run. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because there is a real difference between an action you can reconstruct afterwards and one that left no trace. It is not defence, but it is the difference between a scoped investigation and guessing.

Continuously for critical controls and at least monthly for the broad library. Anything less and the drift figure covers so long a window that you cannot tie a regression to the change that caused it.