Cloud Attack Surface Calculator

Size and score a cloud attack surface from public endpoints, exposed management ports, public data stores, unauthenticated APIs and known exploited CVEs.

Inputs

Public IP addressesaddresses

Public HTTP or API endpointsendpoints

Distinct open ports across those endpointsports

Publicly readable object storesbuckets

Databases reachable from the internetdatabases

Endpoints exposing SSH, RDP or an admin consoleendpoints

API endpoints with no authenticationendpoints

Certificates expiring within 30 dayscertificates

Known exploited CVEs on internet-facing assetsCVEs

Public HTTP endpoints behind a WAF%

Attack Surface Score

89.3/ 100

Risk Level

Critical

Weighted Surface Units

584units

Weighted Exposure Risk

217points

Critical Exposures

29assets

Open Ports per Public Endpoint

4.92

Surface Size Penalty

55.1points

Fastest Surface Reduction

Patch the known exploited CVEs on internet-facing assets — these are being used against real targets today

Step by step

Values used
Public IP addresses = 186 addresses; Public HTTP or API endpoints = 240 endpoints; Distinct open ports across those endpoints = 1,180 ports; Publicly readable object stores = 6 buckets; Databases reachable from the internet = 3 databases; Endpoints exposing SSH, RDP or an admin console = 9 endpoints; API endpoints with no authentication = 11 endpoints; Certificates expiring within 30 days = 4 certificates; Known exploited CVEs on internet-facing assets = 5 CVEs; Public HTTP endpoints behind a WAF = 58 %
Cloud Attack Surface
Weighted surface units = public IPs + public endpoints + 5 × public buckets + 10 × public databases + 4 × unauthenticated APIs + 6 × exposed management endpoints.
Surface scoring
Score = min(60, 6 × log2(surface units)) + min(40, 0.2 × weighted risk) − 0.1 × WAF coverage, clamped to 0–100.
Attack Surface Score
= 89.3 / 100
Risk Level
= Critical
Weighted Surface Units
= 584 units
Weighted Exposure Risk
= 217 points
Critical Exposures
= 29 assets
Open Ports per Public Endpoint
= 4.92

How it works

Surface size is scored logarithmically because the difference between 10 and 100 public endpoints matters far more than between 500 and 600 — past a point you are managing a population rather than a list. Composition is scored separately and linearly, because one internet-facing database or one known exploited CVE is a specific, actionable exposure regardless of how large the estate is. Attackers enumerate rather than target: they scan the whole internet, find the one management port or unpatched edge appliance, and work from there — so the size and the composition of your surface both decide how quickly they find you.

Formulas

Cloud Attack Surface

Weighted surface units = public IPs + public endpoints + 5 × public buckets + 10 × public databases + 4 × unauthenticated APIs + 6 × exposed management endpoints.

surfaceUnits: Size of the internet-reachable surface, weighted by asset danger
publicDatabases: Databases with a route from the internet
unauthenticatedApis: API endpoints requiring no credential

Surface scoring

Score = min(60, 6 × log2(surface units)) + min(40, 0.2 × weighted risk) − 0.1 × WAF coverage, clamped to 0–100.

sizePenalty: Logarithmic penalty for surface size
riskPenalty: Penalty for what the surface actually exposes
wafCredit: Credit of up to 10 points for full WAF coverage

Frequently Asked Questions

How is Cloud Attack Surface calculated?

Weighted surface units = public IPs + public endpoints + 5 × public buckets + 10 × public databases + 4 × unauthenticated APIs + 6 × exposed management endpoints. Surface size is scored logarithmically because the difference between 10 and 100 public endpoints matters far more than between 500 and 600 — past a point you are managing a population rather than a list. Composition is scored separately and linearly, because one internet-facing database or one known exploited CVE is a specific, actionable exposure regardless of how large the estate is.

Why does Cloud Attack Surface matter?

Attackers enumerate rather than target: they scan the whole internet, find the one management port or unpatched edge appliance, and work from there — so the size and the composition of your surface both decide how quickly they find you.

What values do I need to enter?

This calculator takes 10 inputs: Public IP addresses, Public HTTP or API endpoints, Distinct open ports across those endpoints, Publicly readable object stores, Databases reachable from the internet, Endpoints exposing SSH, RDP or an admin console, API endpoints with no authentication, Certificates expiring within 30 days, Known exploited CVEs on internet-facing assets, Public HTTP endpoints behind a WAF. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why weight known exploited CVEs so heavily?

Because they are the ones being used right now. A vulnerability in the CISA known-exploited catalogue has confirmed in-the-wild exploitation, so its practical likelihood is close to one for anything internet-facing. Twelve points each puts a handful of them on par with an entire mid-sized surface.

Is a smaller surface always better?

A smaller surface is easier to defend, but composition matters more. Ten well-instrumented endpoints behind a WAF with authentication are safer than three endpoints where one is an unauthenticated admin console. Reduce what you cannot defend, then defend what remains.

You might also need

Public IP Exposure Calculator Cloud Security Group Calculator Cloud Security Health Score Calculator