Identity Risk Calculator

risk = 0.45 × MFA gap + 2.2 × privileged density + 1.6 × stale rate + 2.5 × shared account rate + 3 × breached credential rate + 1.8 × unrotated service account rate. Each factor is expressed as a rate so organisations of different sizes are comparable, then weighted by how directly it leads to account takeover. Breached credentials carry the heaviest weight because they need no attacker skill at all, and shared accounts follow because nothing about them can be attributed to a person.

Ranking drivers matters more than the composite score: it tells you whether the next sprint should go to MFA enrolment, secret rotation or dismantling shared accounts.

This calculator takes 7 inputs: Identities in scope, Privileged identities, Identities with MFA enforced, Accounts unused for 90 days, Shared or generic accounts, Credentials found in breach data, Service accounts with unrotated secrets. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because credential stuffing needs no exploit and no skill — the attacker already has a working username and password and only has to find where it was reused. This is also why MFA coverage is the paired control: it is the difference between a breached credential being an incident and being a login failure.

Anything that can change security state: cloud administrators, domain and enterprise admins, database owners, CI/CD pipeline identities, and any account holding a privilege-escalation permission. Judging privilege by job title rather than by effective permissions is what makes the density figure look artificially low.