Industrial Cybersecurity & OT Risk calculator

Remote Access Risk Score Calculator

Use this calculator to score defensive remote access risk for OT support paths. It focuses on business impact, exposure, and control strength for vendor or internal remote access into industrial environments.

What this calculator does

  • Rank remote access risk using operational impact, access exposure, and control weakness.
  • Use it when reviewing vendor access, jump hosts, VPN access, privileged sessions, and remote support controls for OT environments.
  • The result gives a relative score for prioritizing remote access risk reduction.

Formula used

  • Remote access risk score = remote access impact score × remote access exposure score × remote access control weakness score
  • Use the same scoring scale across comparable remote access paths.

Inputs explained

  • Remote access impact score: Score the consequence if the remote access path affects PLCs, HMIs, SCADA, safety adjacent systems, production, quality, or utilities.
  • Remote access exposure score: Score exposure based on session frequency, vendor dependence, internet facing dependencies, shared accounts, and unmanaged access paths.
  • Remote access control weakness score: Score weakness in MFA, jump host controls, session approval, logging, time limits, account review, and monitoring.

How to use the result

  • Use it to prioritize MFA, session approval, vendor account review, jump host logging, and remote access segmentation.
  • It is a defensive ranking tool and does not provide instructions for bypassing access controls.

Common questions

  • What is the remote access risk score calculator for? It ranks OT remote access paths by business impact, exposure, and control weakness.
  • What information should I enter? Use consistent scores for impact, exposure, and control weakness.
  • What does the result tell me? The result helps decide which vendor or support access paths need tighter controls first.
  • When is the result only an estimate? It is only an estimate when session logs, account ownership, or control evidence is incomplete.

Last reviewed 2026-05-12.