Skip to content
ENExplore Calculators

Security Group Coverage Calculator

Audit cloud security group hygiene: resource coverage, internet-open ingress rules, unused groups and a hygiene grade.

About Security Group Coverage Calculator

Coverage is the headline: any resource still on the default group inherits whatever that group permits. The composite score then penalises internet-open ingress rules four times as heavily as their raw share, because a single 0.0.0.0/0 rule on a management port is worth far more risk than its 1-in-940 weighting suggests, and lightly penalises orphaned groups as review noise. Default security groups and forgotten 0.0.0.0/0 rules are the two most common causes of internet-exposed cloud databases, and both are invisible unless you measure coverage rather than counting rules.

Formula

Security Group Coverage

hygiene = 0.5 × coverage + 0.3 × (100 − 4 × open-rule share) + 0.2 × (100 − unused-group share).

coverage
Share of resources attached to a purpose-built group
open-rule share
Percentage of ingress rules whose source is 0.0.0.0/0

Worked example

With the default values below, Security Group Coverage Calculator returns Resource Coverage of 95.83%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Resources in scopeaccepts 1–1,000,000 resources
1,200 resources
Resources with a non-default security groupaccepts 0–1,000,000 resources
1,150 resources
Security groups definedaccepts 1–100,000 groups
180 groups
Total ingress rulesaccepts 1–1,000,000 rules
940 rules
Ingress rules open to 0.0.0.0/0accepts 0–100,000 rules
22 rules
Security groups attached to nothingaccepts 0–100,000 groups
35 groups

Results

Resource Coverage
95.83%
Resources Without a Group
50
Internet-Open Rule Share
2.34%
Unused Group Share
19.44%
Ingress Rules per Group
5.22
Hygiene Score
91.2 /100
Hygiene Grade
A — Excellent

Step by step

  1. 1Values used
  2. 2Security Group Coverage
  3. 3Resource Coverage= 95.83
  4. 4Resources Without a Group= 50
  5. 5Internet-Open Rule Share= 2.34
  6. 6Unused Group Share= 19.44
  7. 7Ingress Rules per Group= 5.22
  8. 8Hygiene Score= 91.2 /100

Assumptions and limits

  • The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Security Group Coverage calculated?

hygiene = 0.5 × coverage + 0.3 × (100 − 4 × open-rule share) + 0.2 × (100 − unused-group share). Coverage is the headline: any resource still on the default group inherits whatever that group permits. The composite score then penalises internet-open ingress rules four times as heavily as their raw share, because a single 0.0.0.0/0 rule on a management port is worth far more risk than its 1-in-940 weighting suggests, and lightly penalises orphaned groups as review noise.

Why does Security Group Coverage matter?

Default security groups and forgotten 0.0.0.0/0 rules are the two most common causes of internet-exposed cloud databases, and both are invisible unless you measure coverage rather than counting rules.

What values do I need to enter?

This calculator takes 6 inputs: Resources in scope, Resources with a non-default security group, Security groups defined, Total ingress rules, Ingress rules open to 0.0.0.0/0, Security groups attached to nothing. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Are all 0.0.0.0/0 ingress rules bad?

No — a public web tier legitimately needs 80 and 443 open to the world. The rules that matter are 22, 3389, 3306, 5432, 6379, 9200 and 27017 open to 0.0.0.0/0. Split your count by port before drawing conclusions, and treat any management or database port as an incident, not a finding.

Related Calculators

Security Group Coverage Calculator | Calcrivo