Convert CSPM findings into a 0-100 posture score by weighting critical, high, medium and low findings and normalising per 100 cloud resources.
Raw finding counts scale with estate size, so a thousand findings across forty thousand resources is a better posture than two hundred across five hundred. Normalising weighted findings per hundred resources removes that bias, and the 1.5 penalty factor is calibrated so an estate with roughly one weighted point per two resources lands in the failing band. CSPM tools hand you tens of thousands of findings and no way to tell whether this quarter is better than last, and a density-normalised score is the only version of the number that survives the estate doubling in size.
Cloud Misconfiguration
Weighted findings = critical × 10 + high × 5 + medium × 2 + low × 0.5. Posture score = 100 − min(100, 1.5 × weighted findings per 100 resources).
Remediation backlog
Manual backlog = findings not auto-remediated × mean time to remediate, expressed in finding-days — the work-in-progress a human queue has to absorb.
Weighted findings = critical × 10 + high × 5 + medium × 2 + low × 0.5. Posture score = 100 − min(100, 1.5 × weighted findings per 100 resources). Raw finding counts scale with estate size, so a thousand findings across forty thousand resources is a better posture than two hundred across five hundred. Normalising weighted findings per hundred resources removes that bias, and the 1.5 penalty factor is calibrated so an estate with roughly one weighted point per two resources lands in the failing band.
CSPM tools hand you tens of thousands of findings and no way to tell whether this quarter is better than last, and a density-normalised score is the only version of the number that survives the estate doubling in size.
This calculator takes 8 inputs: Cloud resources in scope, Critical findings, High findings, Medium findings, Low findings, Suppressed or accepted findings, Findings closed by auto-remediation, Mean time to remediate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because otherwise every autoscaling event changes your security score. A team that launches 500 EC2 instances for a batch job would show a posture collapse using raw counts, even though the per-resource configuration is identical. Density answers 'how well do we configure things', which is the question you can act on.
Not in the weighted total here, but the suppression ratio is reported alongside it deliberately. Suppression is a legitimate risk-acceptance tool and also the easiest way to fake a posture score, so the two numbers belong on the same screen.