East-West Security Calculator

east-west traffic = total × east-west share; exposed paths = workloads × flows per workload × (1 − agent coverage). Most data centre traffic never passes the perimeter firewall, so perimeter inspection coverage says nothing about lateral movement. Weighting the east-west volume by agent coverage gives the traffic still flowing uninspected, and multiplying workloads by their peer flows gives the concrete number of paths an attacker could still use.

Every uninspected lateral path is a route from an initial foothold to a crown-jewel system, and the exposed-path count is far more actionable in a risk review than a coverage percentage.

This calculator takes 5 inputs: Workloads in the data centre, Total data centre traffic, Share of traffic that is east-west, Workloads with an enforcement agent deployed, Distinct peer flows per workload. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Partly. Hypervisor-level or fabric-level enforcement covers virtual machines without touching the guest, and cloud-native security groups cover instance-to-instance traffic. What neither sees is traffic between containers on the same host or between processes in the same pod, which is where agent or service-mesh enforcement is the only option.