Security scorecard

Is your cluster actually secure?

Eleven yes/no questions — the same controls we check first in real production audits, weighted by blast radius. Two minutes, a score out of 100, and a prioritized list of exactly where you are exposed.

Automated, encrypted backups — with a restore you have actually tested?

Secrets encrypted at rest in a vault/KMS — not plaintext in env files or etcd?

No database ports published on public IPs (or TLS + strict allowlisting if they are)?

Least-privilege RBAC with per-user identity — no shared admin credentials?

SSH is key-only, with password authentication disabled?

MFA enforced on your cloud console and Git provider?

Default-deny network policies / segmentation between workloads?

Disaster-recovery / restore drill run in the last 90 days?

Audit logging enabled and shipped somewhere tamper-resistant?

Container images scanned (and ideally signed) in CI before they can deploy?

Automatic security patching for OS and base images?

Scored right here in your browser — nothing is sent unless you choose to email it to yourself.

Your security score

58 /100

AT RISK · hardened ≥85 · at risk 55–84 · exposed <55

A real posture, but with holes an attacker — or an outage — will find before you do. Close the critical gaps first.

Your gaps, worst first (5)

Plaintext secrets CRITICALAnyone with node, repo or etcd access walks away with every credential you have — one leaked laptop or malicious dependency becomes a full compromise.
Flat internal network HIGHWithout segmentation, one compromised pod or VM can reach everything else — a small breach becomes lateral movement straight to your data stores.
No recent DR drill HIGHAn RTO you have never measured is fiction. Teams discover the missing pieces — DNS, secrets, runbooks — during the real incident, the most expensive possible time.
No usable audit trail MEDIUMWhen something does happen, you cannot answer "what did they touch?" — which turns a contained incident into a full-scope breach disclosure.
Unscanned, unsigned images MEDIUMKnown-critical CVEs and tampered base images sail straight to production — and you cannot prove that what is running actually came from your pipeline.

Honest caveat: this is a self-assessment, not a penetration test. A real audit finds what you didn’t know to check — misconfigurations, over-broad IAM, the port someone opened “temporarily” last year.

Get a real security audit — free →Book a call →

How the score works

Weighted like a real audit.

Eleven controls, not fifty

These are the checks that decide whether an incident is an inconvenience or an extinction event — the first things we verify when we audit a setup.

Weighted by blast radius

Untested backups, plaintext secrets, internet-facing databases and shared admin access carry the most points — because their failure modes are unrecoverable.

Gaps come prioritized

Every “no” lands on your list sorted by severity, with the reason it matters — so you know what to fix Monday morning, not just that something is wrong.

Verified by a real audit

A checklist scores what you know about. The free audit inspects the actual cluster and cloud accounts — and finds the things nobody thought to ask.

Also free

Security is one half. Cost is the other.

Most teams waste 25–45% of their cloud spend. Estimate yours in sixty seconds with the cost calculator.

Estimate my cloud waste →

Find the gaps before someone else does.

The scorecard shows what you already suspected. The free audit inspects your actual infrastructure — 5–10 concrete findings across security, cost and reliability, with a prioritized fix list. No obligation.

Get the free audit Book a free call ↗

NO SIGNUP · NO OBLIGATION · REPORT IS YOURS TO KEEP