Size and score a cloud attack surface from public endpoints, exposed management ports, public data stores, unauthenticated APIs and known exploited CVEs.
Surface size is scored logarithmically because the difference between 10 and 100 public endpoints matters far more than between 500 and 600 — past a point you are managing a population rather than a list. Composition is scored separately and linearly, because one internet-facing database or one known exploited CVE is a specific, actionable exposure regardless of how large the estate is. Attackers enumerate rather than target: they scan the whole internet, find the one management port or unpatched edge appliance, and work from there — so the size and the composition of your surface both decide how quickly they find you.
Cloud Attack Surface
Weighted surface units = public IPs + public endpoints + 5 × public buckets + 10 × public databases + 4 × unauthenticated APIs + 6 × exposed management endpoints.
Surface scoring
Score = min(60, 6 × log2(surface units)) + min(40, 0.2 × weighted risk) − 0.1 × WAF coverage, clamped to 0–100.
Weighted surface units = public IPs + public endpoints + 5 × public buckets + 10 × public databases + 4 × unauthenticated APIs + 6 × exposed management endpoints. Surface size is scored logarithmically because the difference between 10 and 100 public endpoints matters far more than between 500 and 600 — past a point you are managing a population rather than a list. Composition is scored separately and linearly, because one internet-facing database or one known exploited CVE is a specific, actionable exposure regardless of how large the estate is.
Attackers enumerate rather than target: they scan the whole internet, find the one management port or unpatched edge appliance, and work from there — so the size and the composition of your surface both decide how quickly they find you.
This calculator takes 10 inputs: Public IP addresses, Public HTTP or API endpoints, Distinct open ports across those endpoints, Publicly readable object stores, Databases reachable from the internet, Endpoints exposing SSH, RDP or an admin console, API endpoints with no authentication, Certificates expiring within 30 days, Known exploited CVEs on internet-facing assets, Public HTTP endpoints behind a WAF. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because they are the ones being used right now. A vulnerability in the CISA known-exploited catalogue has confirmed in-the-wild exploitation, so its practical likelihood is close to one for anything internet-facing. Twelve points each puts a handful of them on par with an entire mid-sized surface.
A smaller surface is easier to defend, but composition matters more. Ten well-instrumented endpoints behind a WAF with authentication are safer than three endpoints where one is an unauthenticated admin console. Reduce what you cannot defend, then defend what remains.