Public IP Exposure Calculator

Exposure score = 1.5 × internet-facing percentage + 4 × public admin endpoints + 0.5 × unpatched public host percentage + 0.15 × (100 − WAF coverage), clamped to 0–100. Exposure is scored from four things an attacker actually uses: how much of the estate answers from the internet, whether any of it is an administrative or database port, whether those hosts are patched, and whether HTTP traffic is filtered. Public administrative endpoints dominate at four points each because they are the entry point in the majority of opportunistic cloud intrusions.

Since AWS started charging for every public IPv4 address in 2024, internet exposure has a line item as well as a risk, and both shrink with the same change — put the resource behind a private endpoint or a load balancer.

This calculator takes 9 inputs: Cloud resources in scope, Public IP addresses in use, Allocated but unattached public IPs, Internet-facing load balancers, Public endpoints exposing SSH, RDP or a database port, Public hosts missing a critical patch, Public HTTP endpoints behind a WAF, Public IPv4 price, Billable hours per month. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

It means reachability, which is the precondition. A public IP with a security group allowing nothing inbound is not exposed today, but it is one rule change away, and it still costs $3.65 a month. Prefer private subnets with NAT egress and a load balancer or private endpoint for ingress.

Two reasons: they are pure waste at $3.65 each per month, and they are frequently still referenced in DNS. A released address is reassigned to another tenant within minutes, so a stale record pointing at it becomes a subdomain takeover.