Reproduce the AWS Security Hub score: passed controls over enabled controls per standard, averaged, with a severity-weighted view of the failures.
Security Hub averages standard scores rather than pooling controls, so a small standard moves the number as much as a large one — fifteen failures out of 59 CIS controls costs the same as sixty out of 246 FSBP controls. Because every control counts equally within a standard, the severity-weighted load is reported alongside to show which failures actually matter. The Security Hub percentage is what leadership sees on the dashboard, and it can climb steadily while the six critical failures that would end the company sit untouched.
Security Hub Score
Standard score = passed controls ÷ enabled controls × 100. Overall score = the arithmetic mean of the enabled standard scores, exactly as Security Hub computes it.
Severity weighting
Severity-weighted failure load = 10 × critical failures + 5 × high failures — the view the score itself hides, since every control counts equally in the percentage.
Standard score = passed controls ÷ enabled controls × 100. Overall score = the arithmetic mean of the enabled standard scores, exactly as Security Hub computes it. Security Hub averages standard scores rather than pooling controls, so a small standard moves the number as much as a large one — fifteen failures out of 59 CIS controls costs the same as sixty out of 246 FSBP controls. Because every control counts equally within a standard, the severity-weighted load is reported alongside to show which failures actually matter.
The Security Hub percentage is what leadership sees on the dashboard, and it can climb steadily while the six critical failures that would end the company sit untouched.
This calculator takes 9 inputs: AWS Foundational Security Best Practices controls enabled, FSBP controls passing, CIS AWS Foundations controls enabled, CIS controls passing, PCI DSS controls enabled, PCI DSS controls passing, Controls disabled across all standards, Failed controls at critical severity, Failed controls at high severity. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because the denominator is enabled controls, not applicable controls. Disabling a standard you keep failing is a legitimate scoping decision and also the single easiest way to manufacture improvement, which is why the disabled share is shown here as a first-class number.
No. A control is evaluated against every resource in scope and reports pass or fail as an aggregate, so a single failing control can represent one non-compliant bucket or four hundred. Always read the finding count next to the control count before planning the work.