Skip to content
ENExplore Calculators

Cloud Attack Surface Calculator

Size and score a cloud attack surface from public endpoints, exposed management ports, public data stores, unauthenticated APIs and known exploited CVEs.

About Cloud Attack Surface Calculator

Surface size is scored logarithmically because the difference between 10 and 100 public endpoints matters far more than between 500 and 600 — past a point you are managing a population rather than a list. Composition is scored separately and linearly, because one internet-facing database or one known exploited CVE is a specific, actionable exposure regardless of how large the estate is. Attackers enumerate rather than target: they scan the whole internet, find the one management port or unpatched edge appliance, and work from there — so the size and the composition of your surface both decide how quickly they find you.

Formulas

Cloud Attack Surface

Weighted surface units = public IPs + public endpoints + 5 × public buckets + 10 × public databases + 4 × unauthenticated APIs + 6 × exposed management endpoints.

surfaceUnits
Size of the internet-reachable surface, weighted by asset danger
publicDatabases
Databases with a route from the internet
unauthenticatedApis
API endpoints requiring no credential

Surface scoring

Score = min(60, 6 × log2(surface units)) + min(40, 0.2 × weighted risk) − 0.1 × WAF coverage, clamped to 0–100.

sizePenalty
Logarithmic penalty for surface size
riskPenalty
Penalty for what the surface actually exposes
wafCredit
Credit of up to 10 points for full WAF coverage

Worked example

With the default values below, Cloud Attack Surface Calculator returns Attack Surface Score of 89.3. Change any input above and every figure here is recalculated in your browser.

Inputs used

Public IP addressesaccepts 0–200,000 addresses
186 addresses
Public HTTP or API endpointsaccepts 0–200,000 endpoints
240 endpoints
Distinct open ports across those endpointsaccepts 0–1,000,000 ports
1,180 ports
Publicly readable object storesaccepts 0–100,000 buckets
6 buckets
Databases reachable from the internetaccepts 0–100,000 databases
3 databases
Endpoints exposing SSH, RDP or an admin consoleaccepts 0–100,000 endpoints
9 endpoints
API endpoints with no authenticationaccepts 0–100,000 endpoints
11 endpoints
Certificates expiring within 30 daysaccepts 0–100,000 certificates
4 certificates
Known exploited CVEs on internet-facing assetsaccepts 0–100,000 CVEs
5 CVEs
Public HTTP endpoints behind a WAFaccepts 0–100 %
58 %

Results

Attack Surface Score
89.3 / 100
Risk Level
Critical
Weighted Surface Units
584 units
Weighted Exposure Risk
217 points
Critical Exposures
29 assets
Open Ports per Public Endpoint
4.92
Surface Size Penalty
55.1 points
Fastest Surface Reduction
Patch the known exploited CVEs on internet-facing assets — these are being used against real targets today

Step by step

  1. 1Values used
  2. 2Cloud Attack Surface
  3. 3Surface scoring
  4. 4Attack Surface Score= 89.3 / 100
  5. 5Risk Level= Critical
  6. 6Weighted Surface Units= 584 units
  7. 7Weighted Exposure Risk= 217 points
  8. 8Critical Exposures= 29 assets
  9. 9Open Ports per Public Endpoint= 4.92

Assumptions and limits

  • The result is derived only from the 10 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Cloud Attack Surface calculated?

Weighted surface units = public IPs + public endpoints + 5 × public buckets + 10 × public databases + 4 × unauthenticated APIs + 6 × exposed management endpoints. Surface size is scored logarithmically because the difference between 10 and 100 public endpoints matters far more than between 500 and 600 — past a point you are managing a population rather than a list. Composition is scored separately and linearly, because one internet-facing database or one known exploited CVE is a specific, actionable exposure regardless of how large the estate is.

Why does Cloud Attack Surface matter?

Attackers enumerate rather than target: they scan the whole internet, find the one management port or unpatched edge appliance, and work from there — so the size and the composition of your surface both decide how quickly they find you.

What values do I need to enter?

This calculator takes 10 inputs: Public IP addresses, Public HTTP or API endpoints, Distinct open ports across those endpoints, Publicly readable object stores, Databases reachable from the internet, Endpoints exposing SSH, RDP or an admin console, API endpoints with no authentication, Certificates expiring within 30 days, Known exploited CVEs on internet-facing assets, Public HTTP endpoints behind a WAF. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why weight known exploited CVEs so heavily?

Because they are the ones being used right now. A vulnerability in the CISA known-exploited catalogue has confirmed in-the-wild exploitation, so its practical likelihood is close to one for anything internet-facing. Twelve points each puts a handful of them on par with an entire mid-sized surface.

Is a smaller surface always better?

A smaller surface is easier to defend, but composition matters more. Ten well-instrumented endpoints behind a WAF with authentication are safer than three endpoints where one is an unauthenticated admin console. Reduce what you cannot defend, then defend what remains.

Related Calculators

Cloud Attack Surface Calculator | Calcrivo