Work out firewall rule complexity instantly with clear inputs, formula shown and shareable results.
Firewall policies decay: rules are added for projects and never removed, so shadowed rules accumulate behind broader ones and any-any entries survive from long-forgotten troubleshooting. The hygiene score penalises both, and the evaluation count shows why complexity also costs performance — every rule and object multiplies the worst-case match work per new flow.
Policy complexity
evaluations = rules x objects per rule; hygiene = 100 - shadowed% - 10 x any-any%, floored at 0
They hide intent. An administrator editing a rule that never matches believes they have changed behaviour when they have not, and cleanup later can suddenly open or close unexpected paths.
PCI DSS requires at least every six months. Automated analysis tools that flag shadowing, redundancy and unused rules make it practical to do continuously.