Security Group Coverage Calculator

hygiene = 0.5 × coverage + 0.3 × (100 − 4 × open-rule share) + 0.2 × (100 − unused-group share). Coverage is the headline: any resource still on the default group inherits whatever that group permits. The composite score then penalises internet-open ingress rules four times as heavily as their raw share, because a single 0.0.0.0/0 rule on a management port is worth far more risk than its 1-in-940 weighting suggests, and lightly penalises orphaned groups as review noise.

Default security groups and forgotten 0.0.0.0/0 rules are the two most common causes of internet-exposed cloud databases, and both are invisible unless you measure coverage rather than counting rules.

This calculator takes 6 inputs: Resources in scope, Resources with a non-default security group, Security groups defined, Total ingress rules, Ingress rules open to 0.0.0.0/0, Security groups attached to nothing. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

No — a public web tier legitimately needs 80 and 443 open to the world. The rules that matter are 22, 3389, 3306, 5432, 6379, 9200 and 27017 open to 0.0.0.0/0. Split your count by port before drawing conclusions, and treat any management or database port as an incident, not a finding.