Skip to content
ENExplore Calculators

Public IP Exposure Calculator

Score internet exposure from public IP count, open admin ports, unpatched public hosts and WAF coverage, and price public IPv4 at $0.005 per hour.

About Public IP Exposure Calculator

Exposure is scored from four things an attacker actually uses: how much of the estate answers from the internet, whether any of it is an administrative or database port, whether those hosts are patched, and whether HTTP traffic is filtered. Public administrative endpoints dominate at four points each because they are the entry point in the majority of opportunistic cloud intrusions. Since AWS started charging for every public IPv4 address in 2024, internet exposure has a line item as well as a risk, and both shrink with the same change — put the resource behind a private endpoint or a load balancer.

Formulas

Public IP Exposure

Exposure score = 1.5 × internet-facing percentage + 4 × public admin endpoints + 0.5 × unpatched public host percentage + 0.15 × (100 − WAF coverage), clamped to 0–100.

exposureRatio
Public IPs ÷ all resources × 100
openAdminPorts
Endpoints exposing SSH, RDP or a database port to the internet
wafCoverage
Share of public HTTP endpoints behind a WAF

Public IPv4 charge

Monthly public IPv4 cost = addresses × $0.005 × 730 hours. AWS bills the charge whether the address is attached to a running instance or sitting idle.

ipHourlyPrice
$0.005 per public IPv4 address per hour
idleElasticIps
Allocated addresses attached to nothing

Worked example

With the default values below, Public IP Exposure Calculator returns Internet Exposure Score of 57.3. Change any input above and every figure here is recalculated in your browser.

Inputs used

Cloud resources in scopeaccepts 1–10,000,000 resources
4,200 resources
Public IP addresses in useaccepts 0–200,000 addresses
186 addresses
Allocated but unattached public IPsaccepts 0–200,000 addresses
22 addresses
Internet-facing load balancersaccepts 0–20,000 load balancers
24 load balancers
Public endpoints exposing SSH, RDP or a database portaccepts 0–20,000 endpoints
9 endpoints
Public hosts missing a critical patchaccepts 0–200,000 hosts
31 hosts
Public HTTP endpoints behind a WAFaccepts 0–100 %
58 %
Public IPv4 priceaccepts 0–5 USD/hour
0.005 USD/hour
Billable hours per monthaccepts 1–750 hours
730 hours

Results

Internet Exposure Score
57.3 / 100
Exposure Level
Medium
Share of Estate Internet-Facing
4.43%
Internet-Reachable Entry Points
210 endpoints
Unpatched Share of Public Hosts
16.7%
Monthly Public IPv4 Cost
$678.90
Monthly Cost of Idle Addresses
$80.30
Annual Public IPv4 Cost
$8,146.80
Verdict
Remove the public administrative and database endpoints — replace them with Session Manager, a bastion or a private endpoint

Step by step

  1. 1Values used
  2. 2Public IP Exposure
  3. 3Public IPv4 charge
  4. 4Internet Exposure Score= 57.3 / 100
  5. 5Exposure Level= Medium
  6. 6Share of Estate Internet-Facing= 4.43
  7. 7Internet-Reachable Entry Points= 210 endpoints
  8. 8Unpatched Share of Public Hosts= 16.7
  9. 9Monthly Public IPv4 Cost= 678.90

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Public IP Exposure calculated?

Exposure score = 1.5 × internet-facing percentage + 4 × public admin endpoints + 0.5 × unpatched public host percentage + 0.15 × (100 − WAF coverage), clamped to 0–100. Exposure is scored from four things an attacker actually uses: how much of the estate answers from the internet, whether any of it is an administrative or database port, whether those hosts are patched, and whether HTTP traffic is filtered. Public administrative endpoints dominate at four points each because they are the entry point in the majority of opportunistic cloud intrusions.

Why does Public IP Exposure matter?

Since AWS started charging for every public IPv4 address in 2024, internet exposure has a line item as well as a risk, and both shrink with the same change — put the resource behind a private endpoint or a load balancer.

What values do I need to enter?

This calculator takes 9 inputs: Cloud resources in scope, Public IP addresses in use, Allocated but unattached public IPs, Internet-facing load balancers, Public endpoints exposing SSH, RDP or a database port, Public hosts missing a critical patch, Public HTTP endpoints behind a WAF, Public IPv4 price, Billable hours per month. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Does a public IP always mean exposure?

It means reachability, which is the precondition. A public IP with a security group allowing nothing inbound is not exposed today, but it is one rule change away, and it still costs $3.65 a month. Prefer private subnets with NAT egress and a load balancer or private endpoint for ingress.

Why are idle addresses called out separately?

Two reasons: they are pure waste at $3.65 each per month, and they are frequently still referenced in DNS. A released address is reassigned to another tenant within minutes, so a stale record pointing at it becomes a subdomain takeover.

Related Calculators

Public IP Exposure Calculator | Calcrivo