When you open your Vigilare dashboard, the first thing you see is your risk score — a number from 0 to 100. A higher score means a healthier account. But what does "healthy" actually mean, and what goes into the calculation?
The Four Dimensions
Your risk score is a weighted composite of four health dimensions, each reflecting a different aspect of your AWS account's status.
Security Posture (35% of score)
This dimension evaluates your protection against active threats and misconfigurations. It draws on GuardDuty findings (active threats, credential compromise indicators), IAM configuration (root MFA status, access key age, overly permissive policies), security group configurations (open ports, unrestricted access rules), and encryption status (S3 buckets, EBS volumes, RDS instances).
A perfect security posture score means: no active GuardDuty findings, root MFA enabled, no long-lived access keys, no overly permissive IAM policies, no security groups open to the world, and encryption enabled on all storage.
Billing Health (25% of score)
This dimension tracks whether your costs are normal and sustainable. It evaluates current spend against your rolling baseline (deviations reduce the score), payment method validity (expired cards or failed charges reduce it significantly), budget utilization (approaching or exceeding budgets reduces the score), and spending velocity (accelerating spend trends get flagged before they become anomalies).
A perfect billing health score means: spending within normal range, valid payment method, budgets not exceeded, and no unusual cost trends.
Compliance Status (25% of score)
This dimension measures how well your account configurations align with security best practices. It evaluates AWS Config rule compliance (percentage of rules passing), CloudTrail status (enabled, multi-region, with log file validation), S3 public access settings (account-level block enabled), and VPC flow log status.
A perfect compliance score means: all Config rules passing, CloudTrail properly configured, no public S3 access, and VPC flow logs enabled.
Operational Health (15% of score)
This dimension tracks the operational signals that can lead to service disruptions or account issues. It includes service quota utilization (approaching quotas reduce the score), SES reputation metrics (bounce and complaint rates), AWS Health Dashboard events (active issues or abuse notifications), and resource utilization patterns (idle or underutilized resources).
A perfect operational health score means: all service quotas below 80% utilization, SES metrics within safe ranges, no active Health Dashboard events, and no flagged resource issues.
What Each Score Range Means
90-100: Excellent. Your account is well-configured and actively maintained. Keep doing what you're doing. Review findings weekly to maintain this level.
70-89: Good. Your account has a solid foundation with some areas for improvement. Most findings in this range are informational — security group tightening, access key rotation, minor compliance gaps. Address them when convenient.
50-69: Needs Attention. There are meaningful risks that should be addressed this week. Common causes: GuardDuty findings that haven't been triaged, IAM users without MFA, Config rules failing, or billing trends that are moving in the wrong direction.
30-49: At Risk. Your account has significant issues that increase the probability of a security incident or AWS enforcement action. Common causes: active security findings, billing anomalies, expired payment methods, or SES reputation problems. Prioritize remediation.
Below 30: Critical. Immediate action required. At this level, one or more dimensions are in a state that could result in account suspension, data exposure, or significant financial damage. Drop everything and address the critical findings first.
How the Score Changes Over Time
Your risk score is recalculated every 5 minutes as new data arrives. It goes up when findings are resolved, security configurations improve, billing returns to normal, or compliance gaps are closed. It goes down when new findings appear, configurations drift, costs spike, or operational metrics degrade.
The Vigilare dashboard includes a trend chart showing your risk score over time. A declining trend — even if the absolute score is still acceptable — is an early warning signal. An account that was at 85 last week and is at 72 today is heading in the wrong direction, and the underlying cause should be investigated before the score drops further.
Improving Your Score
Click into your risk score on the dashboard to see the breakdown by dimension. Each finding includes the specific issue, the impact on your score, and the remediation steps. Findings are sorted by impact — the ones at the top of the list will move your score the most when resolved.
The highest-impact actions are almost always in the security dimension: enabling root MFA, resolving active GuardDuty findings, and fixing overly permissive IAM policies. These are also the actions that most reduce your actual risk — the score and the reality are aligned by design.
Related Reading
Protect your AWS accounts before it's too late
Vigilare monitors your AWS accounts for suspension risks — billing anomalies, IAM issues, GuardDuty findings, and more — and alerts you before AWS takes action.
Written by Vigilare Engineering
Platform Team