A computing system for performing threat assessment by detecting interface services that are externally exposed with insufficient protection in a multi-cluster system that includes a plurality of clusters (101, 102, 103, 104, 105) of machine nodes, each cluster running one or more applications, and each application having an interface service that exposes the corresponding application as a network service, the computing system comprising: one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, if executed by the one or more processors, the computing system is configured to: identifying a group of interface services that have one or more common characteristics; identifying the group of interface services as sensitive based on an amount of plurality the clusters that permit the interface services to be connected from outside the respective cluster; for each of at least some of the plurality of interface services within the multi-cluster system, estimating that a corresponding interface service within a corresponding cluster is misconfigured so as to be improperly connectable external to the corresponding cluster in response to the following determinations: determining that the corresponding interface service also has the one or more common characteristics; determining that the corresponding interface service is connectable outside the corresponding cluster; and determining that a corresponding application that the corresponding interface service exposes as a network service does not require authentication. one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, if executed by the one or more processors, the computing system is configured to: identifying a group of interface services that have one or more common characteristics; identifying the group of interface services as sensitive based on an amount of plurality the clusters that permit the interface services to be connected from outside the respective cluster; for each of at least some of the plurality of interface services within the multi-cluster system, estimating that a corresponding interface service within a corresponding cluster is misconfigured so as to be improperly connectable external to the corresponding cluster in response to the following determinations: determining that the corresponding interface service also has the one or more common characteristics; determining that the corresponding interface service is connectable outside the corresponding cluster; and determining that a corresponding application that the corresponding interface service exposes as a network service does not require authentication. identifying a group of interface services that have one or more common characteristics; identifying the group of interface services as sensitive based on an amount of plurality the clusters that permit the interface services to be connected from outside the respective cluster; for each of at least some of the plurality of interface services within the multi-cluster system, estimating that a corresponding interface service within a corresponding cluster is misconfigured so as to be improperly connectable external to the corresponding cluster in response to the following determinations: determining that the corresponding interface service also has the one or more common characteristics; determining that the corresponding interface service is connectable outside the corresponding cluster; and determining that a corresponding application that the corresponding interface service exposes as a network service does not require authentication. determining that the corresponding interface service also has the one or more common characteristics; determining that the corresponding interface service is connectable outside the corresponding cluster; and determining that a corresponding application that the corresponding interface service exposes as a network service does not require authentication.