Rule set v1.0
Scoring rules
Pilot weights and the expected results for the bundled baseline. These bands are a lab convention, not an external security standard.
Severity bands
The same bands apply to Active Directory and AWS IAM. The score is capped at 100.
- Critical80–100
- High60–79
- Medium30–59
- Low1–29
- No finding0
How to read a score
- A score is the sum of the rules that triggered. It is not a probability of compromise.
- Identity type is context. A service account does not add points by itself.
- A disabled account keeps its configuration score and is labeled Disabled.
- A missing check is shown as Not assessed. It is not treated as a pass.
- The access-key rule uses a 90-day pilot threshold.
Rule weights
| Rule | Source | Points | Trigger |
|---|---|---|---|
| Privileged group membership | Active Directory | 0 | The account is a member of a privileged group. |
| Password never expires | Active Directory | 0 | PasswordNeverExpires is enabled. |
| Administrative AWS policy | AWS IAM | 0 | AdministratorAccess is attached. This check matches the policy name. It does not establish effective permissions. |
| Old active access key | AWS IAM | 0 | An active access key is older than 90 days. |
Expected seed results
These twelve curated accounts sit at the start of the 2500-identity baseline. In the corrected scenario, deployment_user has no finding. Every other seed identity keeps the result below.
| Identity | Score | Severity | Note |
|---|---|---|---|
| administrator.lab AD-001 | 0 | Critical | |
| svc_backup AD-002 | 0 | Critical | |
| jordan.lee AD-003 | 0 | High | |
| riley.chen AD-004 | 0 | No finding | |
| legacy.admin AD-005 | 0 | Critical | Disabled account, score kept |
| svc_reporting AD-006 | 0 | Low | |
| casey.brown AD-007 | 0 | No finding | |
| deployment_user AWS-001 | 0 | Critical | |
| build_pipeline AWS-002 | 0 | Critical | |
| reporting_user AWS-003 | 0 | Low | |
| application_role AWS-004 | 0 | No finding | |
| sandbox_admin_role AWS-005 | 0 | Critical |