Agent Reach Calculator. Your matrix, not our averages.
The Agent Reach Matrix, filled in with your answers instead of our averages. Pick the agent types you run, answer six questions about how they are set up, and see which paths are worth looking at first.
- The matrix is the same one we publish. What changes is that your answers fill it in instead of our averages.
- Six questions, each tied to a mechanism we document: CI tokens, readable secrets, unreviewed MCP servers, standing OAuth grants, shared identities and audit gaps.
- Nothing is sent anywhere. The result is computed in your browser and the shareable link carries your answers in the URL.
- It is a self-assessment, not a scan. Useful to start a review with, not a substitute for one.
Which of these run here?
Pick every type you have, the ones nobody signed off on included. The count only weights the types against each other.
How are they set up?
Answer from what is true today, not from the policy. If you are unsure, answer the way it probably is.
Pick an agent type above and your reach profile appears here. Nothing is sent anywhere.
Which record proves which path.
The calculator points at these when a path shows up in your profile. Every one is a record in the Agent Incident Database, with its primary sources on the page.
How the number is produced.
No black box. Here is the whole calculation, so you can argue with it.
What this is not
It is not a scan. Elmoz sees nothing from this page. Everything is computed in your browser from what you typed, which also means the result is exactly as honest as the answers.
It is not a risk score you can take to a board as a measurement. Two environments with the same number can be in very different shape, because the number says nothing about who owns the identities or how quickly a grant gets removed.
What it is good for: starting the review with a filled table instead of a blank one, and knowing which three paths to open first. The full matrix carries the method and the evidence, and every pattern in it has a record behind it.
Questions, answered.
What the calculator does, where the numbers come from, and what the score is worth.
Does this scan my environment?
No. Nothing is sent anywhere and Elmoz sees none of it. The profile is calculated in your browser from the answers you give, and the shareable link carries those answers in the URL. It is a structured self-assessment, not a measurement.
Where do the baseline values come from?
From the published Agent Reach Matrix: five agent types against four access layers and five data classes, each rated always, often, sometimes or rarely. Your six answers move individual cells up from that baseline. The method and the evidence behind each pattern are on the matrix page.
What does the reach score actually mean?
It is the share of the sensitive surface the agent types you listed can reach, weighted by how many of each you run, on a scale of 0 to 100. It is a conversation starter for a review, not a risk rating, and it is only as good as the answers you put in.
Where the numbers come from.
The framework, the evidence and the definitions behind the calculation.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.