Your cluster is 92% conformant to its hardening benchmark — is the remaining 8% 8% of your risk?

## What the number is "92% conformant" asserts one thing: of the items in that standard which were evaluated against this cluster, 92% were found at the recommended value at the time they were looked at. It is a count with an equal weight per item. It is not a percentage of risk, not a percentage of attack paths, and not a percentage of anything an adversary experiences. The wrong answer this question exists to catch is fluent and comes from good engineers: "we're at 92%, so the remaining 8% is 8% of the risk." The correcting fact is short — a hardening benchmark is a broad-applicability settings list, not a ranked control set — and the consequence is that the relationship between item count and technique removal is not linear **in any direction**. ## Both failure directions are real - **The score is too flattering.** Fifteen failing items out of two hundred, and one of them is the node agent accepting unauthenticated callers. The other fourteen are file paths on a control plane you do not run. You are at 92% and an adversary who can route to a node port has command execution inside every container on it. - **The score is too harsh.** Fifteen failing items, all of them ownership and naming conventions on components you never installed, while every item that takes something from an adversary is green. You are at 92% and there is nothing here worth a sprint. Both are ordinary. Neither is visible in the number, and no amount of precision in the number fixes that, because the defect is in the weighting, not the measurement. ## How to defend the number in the room Do not defend the percentage. Replace it, in the same breath, with a short list: 1. **Name the load-bearing set for this estate** — typically a handful of items, not a hundred. For a Kubernetes estate: the node agent's authentication and authorization path; whether workload identities are granted anything beyond what they need; whether the credentials handed to workloads are short-lived and bound rather than long-lived; whether the admission path will accept a workload asking for the host filesystem or host namespaces. 2. **State each one's condition** — green or red, no percentage. 3. **Say why the rest is hygiene here** — usually a sentence about what you operate and what you do not. 4. **Say what would change the list.** A new component, a control plane you start operating yourself, a change in who can reach the node network. That answer survives a skeptical interviewer. "92%" does not, because the obvious next question — *which* 8% — has no good answer if you never sorted the list. ## The starting position decides the list The most useful correction to make out loud is that the load-bearing set is a function of where the adversary starts, not a property of the standard. Consider a criminal who never exploited anything. They bought a valid workload credential for your cluster from a broker who had it from somewhere else entirely. They now start *inside*, authenticating legitimately. Ask which items still bind them: - **Everything on the authentication path is irrelevant.** Anonymous access disabled, strong authentication on the API server, certificate hygiene — all green, all satisfied, all worth exactly nothing here, because the caller presents a credential the cluster is supposed to accept. - **What binds them is what that identity may do.** Whether the account is scoped to what its workload needs or carries broad verbs across namespaces. Whether the credential is a short-lived, audience-bound token that expires or a long-lived one that works for a year. Whether the admission path lets that identity schedule a workload that mounts the host filesystem, which is how a modest identity becomes a node. So two estates at the same 92% can be in completely different positions, and the difference is not in the score — it is in which of the four buckets the failures fall into and which adversary you actually have. ## What the number is still good for It is not useless. It is a drift signal on a list somebody sane wrote, it is comparable across organisations precisely because nobody tailored it, and a sudden fall is worth looking at. What it cannot do is stand in for the sort. Report it, and never let it be the only number in the conversation. ## The one-line answer No — the score is unweighted by technique removal, so 8% of the items is not 8% of anything an adversary cares about. Ask which items are failing, then ask which of them takes something away from an adversary who starts where yours starts.