Model attacker paths beyond the first foothold. Tune inputs for identity, network, and detection gaps. Get a clear score, then reduce spread fast today.
Use 0–10 scales for posture and exposure. Higher exposure is worse; higher control coverage is better. Weights are normalized automatically.
These sample rows illustrate how different control coverage and exposure levels influence overall risk.
| Scenario | Exposure avg | Controls avg | Detect avg | Impact | Indicative score | Indicative level |
|---|---|---|---|---|---|---|
| Segmented admin tiers | 3.0 | 8.0 | 7.5 | 3 | ~22 | Low |
| Mixed posture, moderate sprawl | 5.5 | 5.5 | 5.0 | 3 | ~48 | Moderate |
| Weak segmentation, reused admins | 7.0 | 3.5 | 4.0 | 4 | ~67 | High |
| Credential compromise + reachability | 7.5 | 3.0 | 3.5 | 5 | ~84 | Critical |
This tool produces a 0–100 score by combining four pillars. Each pillar is computed as a weighted average of factors mapped to a 0–100 scale.
After an initial foothold, intruders seek faster privilege and broader reach. This calculator turns that “spread potential” into a repeatable 0–100 score so teams can compare business units, networks, or projects using the same yardstick, using consistent inputs. Scores under 25 indicate limited movement paths with strong containment. Scores above 75 suggest rapid propagation risk where a single compromised account can pivot into critical systems.
Exposure fields rate how easy it is to hop between hosts. A credential exposure of 8–10 fits environments with secrets in scripts, shared drives, or unmanaged endpoints. Shared/local admin reuse increases when the same password, token, or group membership appears on many machines. Protocol exposure rises when SMB, RDP, WinRM, or SSH are reachable beyond management zones. The endpoints-in-scope value is bucketed to approximate attack surface; larger fleets typically mean more misconfigurations and more credential residue.
Controls are entered as strength, but the model converts them into deficit: (10 − control) to reflect residual weakness. Segmentation, admin MFA, privilege management, patch hygiene, service-account governance, and hardening each reduce the probability that a pivot succeeds. If your segmentation is 3/10, the deficit is 7/10, which heavily elevates risk. Mature privilege controls also shrink the impact of reused credentials by limiting session scope and duration.
Detection inputs measure how quickly you can spot and contain lateral techniques. Higher EDR coverage and monitoring quality reduce deficit, while MTTR increases it. MTTR below 12 hours limits spread; 24–72 hours enables multi-hop movement; beyond 72 hours can permit persistence and privilege escalation attempts.
Run at least three scenarios: current state, “quick wins,” and target state. Quick wins may include admin MFA expansion, unique local admin passwords, and restricting remote management to jump hosts. The calculator also applies small adjustments for recent credential compromise, reachable sensitive segments, high privileged-account counts, and long secret rotation cycles. Compare the top drivers list across scenarios; if “Segmentation gap” remains a driver, invest in tiered zoning. If “Slow response window” dominates, automate isolation and streamline escalation paths.
It summarizes how likely an attacker can pivot and expand privileges after a foothold, combining exposure, control gaps, detection weakness, and impact. Higher scores indicate faster spread potential and harder containment.
Use measurable evidence: scan results, admin group counts, protocol reachability maps, MFA coverage reports, and patch SLAs. Prefer enforcement data over policy text, and reassess values after major architecture changes.
Strong controls reduce lateral success probability, so the model treats missing coverage as residual weakness. Enter higher numbers for better coverage, and the calculator automatically converts them to “gap” values for scoring.
Weights decide how much each pillar drives the final score. Enter any non‑negative values; the tool normalizes them into a 100% split, letting you emphasize exposure-heavy threats or response-heavy constraints.
Yes. Map endpoints to workloads, rate protocol exposure as management-plane reachability, and treat service accounts, tokens, and federated identities as credential exposure. Keep MTTR aligned with your incident response process.
Start with identity and segmentation: enforce MFA for privileged actions, remove standing admin rights, deploy unique local admin passwords, and restrict remote management to jump hosts. Expand EDR coverage, centralize logs, and automate containment to cut MTTR quickly.
Important Note: All the Calculators listed in this site are for educational purpose only and we do not guarentee the accuracy of results. Please do consult with other sources as well.