Skip to content
ENExplore Calculators

Overall Security Posture Calculator

Combine prevention, detection, response and recovery capability with exposure and threat level into one posture score.

About Overall Security Posture Calculator

Posture is capability adjusted for reality: what you can do, discounted by how much of it has actually been tested, then reduced by exposed attack surface, known-unpatched vulnerabilities and the threat level you face. The vulnerability penalty is logarithmic because the first few overdue criticals matter far more than the difference between eighty and a hundred. The score is a prioritisation estimate for sequencing work, not assurance that an attack would fail. Two organisations with identical controls have different postures if one faces state-aligned targeting and the other does not — posture is only meaningful relative to the adversary.

Formula

Overall Security Posture

capability = 0.30×prevention + 0.28×detection + 0.24×response + 0.18×recovery; posture = capability × validationFactor − attackSurface penalty − vulnerability penalty − threat penalty.

validationFactor
0.7 to 1.0 depending on the share of controls proven by testing
attackSurface penalty
0.08 points per point of external exposure
vulnerability penalty
Logarithmic penalty for overdue critical vulnerabilities, capped at 14 points
threat penalty
20 points per unit above a moderate threat level — up to 6 points at high threat

Worked example

With the default values below, Overall Security Posture Calculator returns Overall Security Posture of 40.7. Change any input above and every figure here is recalculated in your browser.

Inputs used

Prevention capabilityaccepts 0–100 / 100
72 / 100
Detection capabilityaccepts 0–100 / 100
65 / 100
Response capabilityaccepts 0–100 / 100
60 / 100
Recovery capabilityaccepts 0–100 / 100
68 / 100
External attack surface exposureaccepts 0–100 / 100
55 / 100
Critical vulnerabilities past SLAaccepts 0–100,000 vulnerabilities
18 vulnerabilities
Threat level facing the organisationone of Low — opportunistic attacks only — 0.9×, Moderate — commodity ransomware and phishing — 1.0×, Elevated — targeted criminal interest — 1.15×, High — state-aligned or hacktivist targeting — 1.3×
Elevated — targeted criminal interest — 1.15×
Controls validated by testing in the last yearaccepts 0–100 %
55 %

Results

Overall Security Posture
40.7 / 100
Posture Rating
D — Weak
Capability Score
66.4 / 100
Total Deductions
16.7 points
Residual Risk
59.3 / 100
Assurance Level
Partially evidenced — around half the score rests on untested assumptions
Priority Action
Clear the critical vulnerabilities past SLA — known and unpatched is the most common initial access

Step by step

  1. 1Values used
  2. 2Overall Security Posture
  3. 3Overall Security Posture= 40.7 / 100
  4. 4Posture Rating= D — Weak
  5. 5Capability Score= 66.4 / 100
  6. 6Total Deductions= 16.7 points
  7. 7Residual Risk= 59.3 / 100
  8. 8Assurance Level= Partially evidenced — around half the score rests on untested assumptions

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Overall Security Posture calculated?

capability = 0.30×prevention + 0.28×detection + 0.24×response + 0.18×recovery; posture = capability × validationFactor − attackSurface penalty − vulnerability penalty − threat penalty. Posture is capability adjusted for reality: what you can do, discounted by how much of it has actually been tested, then reduced by exposed attack surface, known-unpatched vulnerabilities and the threat level you face. The vulnerability penalty is logarithmic because the first few overdue criticals matter far more than the difference between eighty and a hundred. The score is a prioritisation estimate for sequencing work, not assurance that an attack would fail.

Why does Overall Security Posture matter?

Two organisations with identical controls have different postures if one faces state-aligned targeting and the other does not — posture is only meaningful relative to the adversary.

What values do I need to enter?

This calculator takes 8 inputs: Prevention capability, Detection capability, Response capability, Recovery capability, External attack surface exposure, Critical vulnerabilities past SLA, Threat level facing the organisation, Controls validated by testing in the last year. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does the threat level change the score?

Because the same gap has different consequences depending on who is probing it. A 10-point weakness against opportunistic attackers is survivable; against a determined targeted adversary it is where the intrusion starts, so an elevated threat level deducts directly.

Why does untested capability score lower?

Because self-reported capability is systematically optimistic. Validation by red team, purple team or breach simulation is what separates a control that exists on a diagram from one that fires — so the model caps unvalidated capability at 70% of its claimed value.

Related Calculators

Overall Security Posture Calculator | Calcrivo