CRC's Consolidate pillar tells you to reduce the number of distinct application edges your organization carries. This page answers the next question: once you've consolidated, how big should each resulting boundary be?
Attack surface counts exposed entry points — open ports, unpatched services, API credentials, every SaaS application wired into a workflow. It asks where an intruder gets in. That's a necessary question, but not a sufficient one.
Isolation surface size picks up where that question leaves off. Once a credential is compromised or a certificate's signing key is stolen — through any door, by any method — how much privilege, how many principals, how much organizational value sat behind that one boundary? A system can have a vanishingly small attack surface and still have a vast isolation surface, if everything inside the perimeter shares one signing key.
The causal direction runs from surface to edges, not the other way around. A wide isolation surface removes the one thing that would otherwise force a decision: when everything already shares the same certificate, a new SaaS connection just gets bolted on, because nothing in the architecture ever asks whether it belongs there or needs a boundary of its own. Surface width is not a side effect of edge count. It is the thing that determines how many edges an organization ends up tolerating — because wide trust boundaries make new integrations feel cheap until the accumulated privilege becomes visible.
A typical mid-enterprise running ServiceNow and Salesforce under the same identity domain — the default configuration for most SSO deployments — combines service accounts, integration users, admin credentials, API keys for connected systems, RPA agents, and automation bots across both platforms. Honest principal count including service accounts: 400–600 distinct privileged identities, all sharing one effective trust boundary through a single IdP credential.
Run those parameters through the formula below at conservative assumptions calibrated to publicly available breach probability data and typical SaaS privilege scope:
Running 500 principals under a single SSO boundary puts total cost roughly 4.5× above the curve's minimum. The formula doesn't say the current configuration is inoperable — it says you are carrying roughly 4.5× more risk-adjusted cost than the same environment, properly partitioned, would require. Use the calculator below to load this profile and adjust it to your own numbers.
Three forces trade off. Safety cost rises with surface size — a certificate that covers more principals is more valuable to compromise. Complexity and convenience costs fall — fewer, larger certificates mean less provisioning overhead and fewer legitimate workflows hitting a boundary. The curve has an interior minimum.
| Symbol | Meaning |
|---|---|
| S | Isolation surface size — principals per certificate |
| T | Total principal population across the deployment |
| p | Per-principal compromise probability |
| v̄ | Average privilege / value per principal |
| c_r | Fixed cost of issuing and maintaining one certificate boundary |
| c_c | Convenience cost per cross-boundary workflow |
| f | Fraction of workflows that cross a boundary |
T cancels out of S* — the optimal surface size is independent of total population. A fifty-principal team and a fifty-thousand-principal enterprise should target the same S*. The enterprise just needs more certificates at that size, not bigger ones.
Adjust the inputs. The optimal surface size, certificates needed, and cost multiple update live. Load a preset profile or add your own.
ISS (Isolation Surface Score) — 100 × Cost(S*) / Cost(T). A score of 100 means the current environment is already sized at its own cost minimum. A score of 50 means the current configuration costs roughly twice what an optimally partitioned deployment of the same scale would require. The score is derived entirely from the formula inputs above — it is an efficiency indicator, not a compliance certification.
Six illustrative configurations, including the ServiceNow + Salesforce shared-domain example. Cost per principal factors out population size for a fair comparison across scales. ISS (Isolation Surface Score) — 100 × Cost(S*) / Cost(T) — shows how close each environment is to its own cost minimum: 100 is fully optimized, lower scores indicate a surface wider than optimal. Load any row to set the calculator to that profile.
| Environment | S* | Certs | Cost / principal | Total cost | ISS |
|---|