Roll eight security pillars and your open finding counts into one application security score with a deduction for live risk.
The pillar weights are ordered by how often each one is the root cause of a real breach, which puts input validation, authentication and access control at the top and configuration at the bottom. The deduction exists because maturity and current exposure are different things: a mature programme with an open critical finding is still exposed today. Programme-level maturity and the open-findings queue are usually reported separately, which lets a good average hide a live critical — combining them stops that.
Web Application Security Score
pillar score = 0.18 input validation + 0.16 authentication + 0.16 access control + 0.14 transport + 0.12 headers + 0.10 dependencies + 0.08 logging + 0.06 configuration, each 0–100.
Live risk deduction
final score = pillar score − (8 × critical + 3 × high + 1 × medium open findings), floored at zero.
pillar score = 0.18 input validation + 0.16 authentication + 0.16 access control + 0.14 transport + 0.12 headers + 0.10 dependencies + 0.08 logging + 0.06 configuration, each 0–100. The pillar weights are ordered by how often each one is the root cause of a real breach, which puts input validation, authentication and access control at the top and configuration at the bottom. The deduction exists because maturity and current exposure are different things: a mature programme with an open critical finding is still exposed today.
Programme-level maturity and the open-findings queue are usually reported separately, which lets a good average hide a live critical — combining them stops that.
This calculator takes 11 inputs: Input validation and encoding, Authentication and session management, Authorisation and access control, Cryptography and transport security, Security headers and browser policy, Dependency and supply-chain hygiene, Logging, monitoring and alerting, Secure configuration and secrets management, Open critical findings, Open high findings, Open medium findings. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
To keep the score honest. Eight points is roughly the difference between two grade bands, so a single exploitable finding visibly moves the number and cannot be averaged away by a strong pillar elsewhere. Adjust the weight if your severity definitions are stricter or looser than the usual ones.