> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Egress Security Score

The Egress Security Score on the Egress > Overview tab provides information on
how well your VPC/VNets are protected by Aviatrix Platform-as-a-Service (PaaS).

<img src="https://mintcdn.com/aviatrix-14b37c43/EV0VWzgSoSn4nUA6/docs/cloud/images/egress-security-score-card.png?fit=max&auto=format&n=EV0VWzgSoSn4nUA6&q=85&s=6d7c17f0075c6da7c6e96686c948cacf" alt="egress-security-score-card" width="1022" height="500" data-path="docs/cloud/images/egress-security-score-card.png" />

Click *Protect VPC/VNets* to open the Protected VPC/VNets tab.

## Egress Security Score Calculation

* Egress Score = (Sum of all scores of individual non-ignored VPC or VNets /
  Total number of non-ignored VPCs) \* 100
* 0 is the lowest score for a VPC/VNet
* 1 is the highest score for a VPC/VNet
* Gateway subnets are excluded
* In AWS, focus on routes that have a next hop of "nat-\*".

| VPC/VNet State | Aviatrix Gateway | Criteria (AWS) | Definition | Score |
| - | - | - | - | - |
| Not Onboarded | None | No Aviatrix Gateways | VPC has no Aviatrix Gateways deployed and has direct access to the Internet. | 0 |
| Unprotected | Yes | <ul><li>0.0.0.0/0 points to the Aviatrix gateway AND there is no Default Deny Rule for the VPC</li><li>OR</li><li>0.0.0.0/0 points to Internet Gateway</li></ul> | VPC has Aviatrix Gateways deployed and direct access to the Internet; traffic to Internet is not logged. | 0 |
| Monitored | Yes | 0.0.0.0/0 points to the Aviatrix gateway AND VPC is in a 'Watch' Rule for Any-Web AND there is no Deny Any-Web Rule for the VPC | VPC has Aviatrix Gateways deployed and traffic to the Internet is being logged. | .5 |
| Partially Protected | Yes | 0.0.0.0/0 points to the Aviatrix Gateway AND there is no Default Deny Rule for the VPC AND the VPC is in another Deny Rule (but not Any-Web) | VPC has some selective traffic to the Internet blocked. | .75 |
| Protected | Yes | 0.0.0.0/0 points to the Aviatrix Gateway AND source VPC; Destination is Public Internet; there is a Deny Rule for the VPC | VPC may have only selective traffic to the Internet allowed. | 1 |
| No Egress | None / Yes | No 0.0.0.0/0 route in the VPC | VPC does not have direct access to the Internet | 1 |
| Ignored | None / Yes | Manually set state | VPC is ignored from Egress Score calculation | N/A |

## Include VPC/VNets in the Egress Score

You can include selected VPC/VNets in the Egress Score calculation.

On the Security > Egress > Protected VPC/VNets tab, click the vertical ellipsis
<img src="https://mintcdn.com/aviatrix-14b37c43/Edj7hoOEnFtUHgGn/docs/cloud/images/threedot.png?fit=max&auto=format&n=Edj7hoOEnFtUHgGn&q=85&s=3a3ab4208305fbec7a6b980b7587419b" alt="threedot" width="44" height="66" data-path="docs/cloud/images/threedot.png" /> next to the VPC/VNet and select *Include
in Egress Score*. The VPC/VNet will be included in the Egress Score calculation.

## Ignore VPC/VNets for the Egress Score

You can exclude selected Unprotected VPC/VNets from being included in the Egress
Score calculation.

On the Security > Egress > Protected VPC/VNets tab, click the vertical ellipsis
<img src="https://mintcdn.com/aviatrix-14b37c43/Edj7hoOEnFtUHgGn/docs/cloud/images/threedot.png?fit=max&auto=format&n=Edj7hoOEnFtUHgGn&q=85&s=3a3ab4208305fbec7a6b980b7587419b" alt="threedot" width="44" height="66" data-path="docs/cloud/images/threedot.png" /> next to the VPC/VNet and select *Ignore
for Egress Score*. The VPC/VNet will not be included in the Egress Score
calculation.

## Related Topics

* [Egress Security Overview](/docs/cloud/security/egress-nat/egress-security-overview)
* [Protect VPC/VNets](/docs/cloud/security/egress-nat/egress-protect-vpc-vnets)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.