Infrastructure as Code Risk Calculator

Risk = min(50, 0.25 × weighted findings per 100 templates) + 0.3 × uncovered percentage + min(15, 2 × drift rate) + min(20, 3 × templates with secrets) + 0.15 × ungated percentage. IaC risk is scored on where the finding is caught rather than only on how many there are: a critical finding blocked on a pull request costs a review comment, while the same finding found after apply is a live misconfiguration. Hardcoded secrets carry a disproportionate 3 points each because the template is only the visible copy — the real one is in git history forever.

One template is applied hundreds of times, so a single insecure default in a shared module is a fleet-wide misconfiguration, and it is far cheaper to fix in the module than in four hundred deployed resources.

This calculator takes 10 inputs: IaC templates or modules, Templates covered by IaC scanning, Critical IaC findings, High IaC findings, Medium IaC findings, Low IaC findings, Templates with a hardcoded credential, Resources drifted from code, Resources managed by IaC, Changes gated by a pre-merge scan. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

No — they catch different things. IaC scanning finds what the code says before it exists; CSPM finds what the cloud actually contains, including everything created by hand, by another team, or by a resource the code does not own. Drift rate is the number that tells you how far apart those two views have grown.

On the pull request, failing the check. A scan that runs after apply and files a ticket has already let the misconfiguration into the account, and the fix now needs a change window rather than a commit. Reserve the post-apply scan for drift detection, which is genuinely a different job.