24 resources sit in two rings around a central data core: an inner ring of 8 storage/database resources and an outer ring of 16 compute/API resources — the layers a real cloud account splits by the Shared Responsibility Model. Each resource has a fixed random baseline (public-facing or not, and whether it draws a misconfiguration under the current rate) so toggling a slider changes outcomes smoothly instead of reshuffling the scene. A misconfigured resource — an open security group, a public storage bucket, disabled MFA — always widens its own exposure, exactly like the OWASP Cloud Top 10 threats it stands in for.
risk_i = exposure_i · privRatio · misconfig_i(1.5) · (1 − 0.5·encrypted_i) · zt(0.35) · w_i
AttackSurface = 100 · mean(risk_i) / risk_max
BreachProb = sigmoid((AttackSurface − 50) / 12)
Compliance = 100 − 0.5·misconfigRate − 0.25·(100 − encryptCoverage) − 8·(privRatio−1) − 15·(1 − zt)
- IAM privilege ratio — average granted-vs-required permission ratio across roles; 1.0× is least-privilege, 6× approximates a wildcard
"Action":"*" policy. Multiplies every resource's risk directly, because an over-privileged identity turns any single compromise into a much bigger one.
- Misconfiguration rate — the share of resources with a real, uncorrected misconfig. A misconfigured resource both gets a 1.5× risk multiplier and becomes exposed even if it wasn't public before — this is deliberately how S3-bucket and open-security-group breaches actually happen.
- Encryption coverage — the share of resources encrypted at rest; halves a breached resource's impact (data is unreadable without the key) but never zeroes it, since a compromised IAM identity can still call the API and read decrypted data.
- Zero Trust segmentation — micro-segmentation and per-request re-verification; when on, it cuts every resource's contribution to the attack surface by 65%, modelling that a compromised node can no longer move laterally to the data core unchecked.
Storage nodes carry a 1.4× impact weight (w_i) — they sit adjacent to the crown-jewel data core, so a breach there matters more than one on a stateless compute node. Lines from a node to the core light up when that node is both exposed and above a risk threshold, tracing a live attack path; Breach probability is a logistic (sigmoid) transform of the normalized attack-surface score, the same shape FAIR/NIST-style risk models use to turn a 0–100 exposure score into a bounded probability.