Folio 4Outside-in · security ratings vendors
Security ratings, scale by scale
The vendors that score companies from the outside, compared on what each publishes about its own rating: the scale, what it measures, how often it updates, and what it claims the score predicts. Bitsight against SecurityScorecard side by side.
A security rating scores a company from what its internet-facing systems show, without asking it anything. The scales don’t match: Bitsight runs 250–900, SecurityScorecard grades A–F over 100 points, UpGuard 0–950, RiskRecon 0–10. Each vendor publishes its own breach-correlation figures, and a peer-reviewed study found different vendors’ scores for the same company don’t fully agree. Use ratings to triage and to monitor, not instead of an assessment.
The scales, drawn to their own range
Each ruler spans the vendor’s published range, with only the bands it publishes. A 700 on one is not a 70 on another: the scales measure different things.
Effective range today 300–820; the edges are reserved. Average rating 720. Source.
Subtractive: assets start at 950 and lose points for failed checks. Source.
A = 90–100; F = 60 or lower. The B, C and D boundaries are not in the article that defines the scale. Source.
Each of nine domains is rated 0–10 and translated to A–F; the letter bands are published only as an image. Source.
Letter grades A through F. 'A cyber rating's overall letter grade is a weighted average across 19 graded technical categories'; category weights total 100. A numeric-to-letter mapping is not published on the pages loaded. Source.
'Each Test has its own internal 0-100 rating'. The final Cyber Posture Rating aggregates Test ratings directly, not category ratings; the methodology page does not state the overall range. Panorays' 2020 'Cyber Risk Rating', which combines questionnaire and posture ratings, uses five levels: bad, poor, fair, good, excellent. Source.
Bitsight vs SecurityScorecard
The two most searched ratings vendors, side by side, from each one’s own pages.
| Bitsight | SecurityScorecard | |
|---|---|---|
| Owner | Privately held; Moody's made a $250 million strategic investment in 2021 | Privately held, venture-backed (backers named by the company include Evolution Equity Partners, Silver Lake Partners, Sequoia Capital, Google Ventures and Riverwood Capital) |
| HQ, founded | Boston, MA, United States, 2011 | New York, NY, 2014 |
| Scale | 250–900 (Bitsight states the upper and lower edges are reserved and the current effective range is 300–820; the security-ratings page describes 300–820); categories Advanced 740–900, Intermediate 640–730, Basic 250–630; each risk vector gets an A–F letter grade | A–F letter grade mapped to a numeric score from 100 to 0 (A = 90–100; F = 60 or lower) |
| Updates | Daily ('We provide daily security ratings ... that leverages 1 year of supporting data'; ratings 'generated and calculated daily'). | 'We update factor and total scores daily'. The scoring algorithm is recalibrated every quarter. The full IPv4 space is scanned every 10 days across 1,400+ ports, and cloud assets multiple times daily. |
| What it rates | 24 risk vectors in 4 risk categories, as of the RAU26 update of 2026-07-16. Weights: Compromised Systems 26%, Diligence 71.5%, User Behavior 2.5%, Public Disclosures (no weight shown). 19 vectors affect the rating; 5 are beta or informational (DNSSEC, Web Application Headers, Domain Squatting, Exposed Credentials, Other Disclosures). The largest individually disclosed weights are Critical Vulnerabilities Management 20% and TLS/SSL Configurations 15%; individual weights inside Compromised Systems are not shown. | 10 factors: Network Security, DNS Health, Patching Cadence, Endpoint Security, IP Reputation, Application Security, Cubit Score, Hacker Chatter, Information Leak, Social Engineering. Issues carry High, Medium or Low severity. |
| Questionnaires | SIG Lite, NIST CSF, ISO 27001, HECVAT, NIST 800-171 / CMMC | SIG, CAIQ |
| Free offer | Free Cyber Risk Report ("Security Ratings Snapshot"): "Get a snapshot of your organization's cybersecurity program, including your Bitsight Security Rating and a benchmark of how you compare to industry peers." | "Free forever accounts" include "Scorecard for your own domain", "Questionnaire response", "Pre-built dashboards Basic report creation"; free trial: "Get immediate access to 5 scorecards of your choosing"; after a trial "the account will revert to a free version" |
| Price | Not published: on request | AWS Marketplace: "SecurityScorecard" listing, 12-month contract (Cost/12 months): SSC Free — "REQUEST QUOTE" — $0.00; SSC Pro — "REQUEST QUOTE" — $0.00; SSC Business — "For vendor management of 5 domains, reporting unlocked" — $13,500.00; SSC Enterprise — "Larger vendor management of 75 domains + onboarding experience" — $155,375.00 |
| Own SOC 2 / ISO | SOC 2 Type 2 · Not held: Bitsight states "BitSight does not, but Amazon AWS, our hosting provider does." | SOC 2 Type II |
| Analysts (as stated) | Named a Leader in The Forrester Wave™: Cybersecurity Risk Ratings Platforms, Q2 2026 | Named a leader in The Forrester Wave™: Cybersecurity Risk Ratings Platforms, Q2 2024 |
Both supported the 2017 U.S. Chamber principles on fair ratings. Full entries, with sources: Bitsight, SecurityScorecard.
What each vendor says its rating predicts
Breach-likelihood figures, quoted as each vendor publishes them. They are the vendors’ own analyses unless a line says otherwise; none discloses who paid for the outside studies it cites.
| Who says it | The claim, verbatim |
|---|---|
| Bitsight | “Basic entities are, on average, 2 - 3x more likely to experience a publicly disclosed data breach than Intermediate entities; entities with a rating of 400 or lower are 5x more likely to experience a publicly disclosed data breach than entities with a security rating of 700 or higher.” source |
| Bitsight | “[Intermediate entities] are, on average, 1.5 - 2x more likely to get breached than entities with Advanced ratings.” source |
| Bitsight | “Companies with a Botnet Infections letter grade of B or lower are >2× more likely to experience a publicly disclosed data breach.” source |
| Bitsight | “Organizations with poor cybersecurity hygiene and performance, reflected in a security rating between 300 - 500, are 7.9x more likely to be a target of a ransomware attack.” source |
| Bitsight (Marsh McLennan Cyber Risk Analytics Center study) | “After comparing the security performance data of thousands of organizations that experienced cybersecurity incidents against those that did not, we identified a statistically significant correlation between Bitsight Security Ratings and the likelihood of a cybersecurity incident," said Scott Stransky, managing director and head of the Cyber Risk Analytics Center at Marsh McLennan.” source |
| Bitsight (Gallagher Re study) | “One of the largest cyber insurance studies of its kind conducted by Gallagher Re leveraging Bitsight data found insurers. Organizations with poor cybersecurity controls are more than 3x more likely to suffer an insurance claim” source |
| SecurityScorecard | “An organization with an F grade (score of 60 or lower) is statistically 13.8 times more likely to sustain a breach than an organization with an A (score of 90 to 100).” source |
| SecurityScorecard (with Marsh McLennan Global Cyber Risk Analytics Center) | “By analyzing security ratings and cyber insurance claims data, we found seven factors that are most predictive of a breach.” source |
| RiskRecon (Mastercard) | “those with very poor cybersecurity hygiene, rated as D or F, have experienced a 35x higher frequency of breach events compared to A rated organizations” source |
| RiskRecon (Mastercard) | “Those with poorest cybersecurity hygiene, rated F, have experienced a 16.6x higher frequency of breach events compared to A rated organizations” source |
| Independent academic study using Bitsight-provided ratings (Choi & Johnson, JAMIA 2021) | “We also found that hospitals with the low security ratings were associated with significant risk of a data breach, with the probability of a breach in a given year ranging from 14% to 33%.” source |
The limits
Keskin. Scores from different ratings companies for the same organization 'do not entirely converge'. The authors found 'variations exist in the assessment by the different cyber risk scoring companies', mainly from different methodologies, proprietary datasets and extra risk factors. They recommend assessment by 'more than one rating company'. Source.
U.S. Chamber of Commerce and supporting companies. 'the variety of sources and the dynamic nature of the environment create risks of producing ratings that can potentially be inaccurate, irrelevant or incomplete.' The principles call for dispute, correction and appeal rights and for disputed ratings to be notated. Source.
Forrester. 'The real value of CRR platforms is in the data and intelligence underlying a rating and their ability to surface actionable risk findings when this data is used correctly.' Source.
Rating vendors' own documentation. Vendors acknowledge that asset attribution can be wrong. SecurityScorecard: 'We also encourage you to validate these attributions by claiming and refuting assets'. Panorays runs a 'Challenging False Positives' process and validates disputes 'within 24 hours'. RiskRecon hired Stratum Security for a 'False Positive Review' of how accurately it associates domains with companies. Source.
The 2017 principles for fair ratings
Voluntary principles for security ratings companies, meant to increase confidence in ratings that 'rely in part upon the quality and breadth of the data they use'. The stated aims of an industry-wide approach: promote quality and accuracy; promote fairness in reporting; include a coordinated process for adjudicating errors or inaccuracies; establish guidelines for appropriate use and disclosure of scores.
- Transparency
- Sufficient transparency into methodologies and data types; any rated organization can access its rating and the data that changed it.
- Dispute, Correction and Appeal
- Rated organizations may challenge ratings; rating companies should have an appeal and dispute process; disputed ratings should be notated until resolved.
- Accuracy and Validation
- Ratings should be empirical and data-driven, or notated as expert opinion; companies should validate methodologies and report historical model performance.
- Model Governance
- Reasonable notice to customers before methodology or data-set changes.
- Independence
- Commercial agreements (or the lack of them) must not directly affect a rating; non-customers can see and challenge their rating.
- Confidentiality
- Protect dispute information; do not publicize an individual organization's rating; do not give third parties information that could lead directly to compromise.
Ratings companies among the published supporters: BitSight, RiskRecon, Security Scorecard (SecurityScorecard), FICO (the June 2017 page linked 'testimonials from our partner organizations: BitSight, FICO, RiskRecon, and SecurityScorecard'). U.S. Chamber of Commerce.
Where ratings fit in a TPRM program
Triage
Rate every vendor on the list before deciding who gets a questionnaire. A poor outside view can move a vendor up a tier.
Monitor between assessments
A yearly questionnaire says nothing about March. Ratings change daily and can trigger a review when a vendor drops.
Find fourth parties
Several ratings vendors map the services your vendors themselves rely on, from what is visible on the internet.
Don’t stop there
A rating can’t see policies, contracts, internal controls or finances. Regulators ask for due diligence and monitoring; none of the texts we checked mentions ratings.
Ratings vendors in the register: 9
Products built on outside-in ratings, and those that add their own outside view to another approach.
| Product | Approach | Scale | Owner | Free offer | Price |
|---|---|---|---|---|---|
| SecurityScorecard | A–F letter grade mapped to a numeric score from 100 to 0 | Privately held, venture-backed | Free trial | Marketplace | |
| UpGuard | 0–950 with A–F letter grade | Privately held, venture-backed | 14-day free trial | Published | |
| Panorays | Cyber Posture Rating from 0–100 | Privately held, venture-backed | Free plan | On request | |
| Bitsight | 250–900 | Privately held | Free report only | On request | |
| Black Kite | A–F letter grade "based on a 100-point scale" | Privately held, venture-backed | Proof of concept | On request | |
| RiskRecon | A–F letter grade translated from a 0–10 numeric rating | Mastercard | 30-day free trial | On request | |
| SAFE TPRM | AI-first assessment | — | Independent, venture-backed | — | Marketplace |
| Interos | — | Independent, venture-backed | — | Marketplace | |
| ProcessUnity | Assessment workflow | — | Private equity: Marlin Equity Partners | Free for suppliers | On request |
7 products built on ratings; checked November 8, 2026.
Questions
What is a security rating?
A score a ratings company gives an organisation from the outside, without asking it anything: it scans and collects what can be seen of the organisation’s internet-facing systems (open ports, patch levels, email and web settings, signs of infected machines, leaked credentials) and turns the findings into a number or letter grade. TPRM teams use them to triage large vendor lists and to watch vendors between assessments.
What is the difference between Bitsight and SecurityScorecard?
The scale and the factors. Bitsight rates on 250 to 900 (effective range 300 to 820 today), updated daily, from 24 risk vectors in four categories. SecurityScorecard gives an A to F grade over a 100-point score, updated daily and recalibrated quarterly, from ten factors. Both are private, both add questionnaires and threat intelligence, and both publish their own breach-correlation figures. Neither publishes a price for third-party risk on its own site.
Are security ratings accurate?
They measure what can be seen from outside, and the vendors see different things. A 2021 peer-reviewed study comparing several ratings companies found their scores for the same organisations “do not entirely converge”, and recommended using more than one. All the vendors run dispute processes for wrongly attributed assets, which the 2017 U.S. Chamber of Commerce principles ask for.
Can I see my company’s security rating for free?
Several vendors offer something: SecurityScorecard (free trial), UpGuard (14-day free trial), Panorays (free plan), Bitsight (free report only), Black Kite (proof of concept), RiskRecon (30-day free trial). The 2017 Chamber principles say any rated organisation should be able to see its own rating.
Do regulators require security ratings?
Not in the texts we checked. The 2023 US interagency guidance, the 2024 community bank guide, the NYDFS third-party guidance of October 2025 and the UK PRA’s SS2/21 do not mention security ratings or scores. They ask for risk-based due diligence and ongoing monitoring; ratings are one way to do the monitoring.
Ratings, questionnaires, or both?
Tell us how many vendors you need to watch and how you assess them today. We reply with the products in this register that fit. We only pass your details to a vendor if you ask us to.
Sources for this page
- Bitsight: how the rating is calculated — Its scale, update frequency and factors.
- SecurityScorecard: how the rating is calculated — Its scale, update frequency and factors.
- RiskRecon (Mastercard): how the rating is calculated — Its scale, update frequency and factors.
- UpGuard: how the rating is calculated — Its scale, update frequency and factors.
- Black Kite: how the rating is calculated — Its scale, update frequency and factors.
- Panorays: how the rating is calculated — Its scale, update frequency and factors.
- U.S. Chamber of Commerce: Principles for Fair and Accurate Security Ratings (2017) — The six principles and the ratings companies that supported them.
- Keskin et al., “Cyber Third-Party Risk Management: A Comparison of Non-Intrusive Risk Scoring Reports”, Electronics, 2021 — That different vendors’ scores for the same organisation do not entirely converge.
- Choi & Johnson, JAMIA 2021 (via Europe PMC) — The peer-reviewed hospital study using Bitsight ratings.
Each product’s own sources are linked from its entry in the register. How products are chosen and ordered, and how to correct an entry: methodology.
Cite this page
Third-Party Risk Management Software. “Security ratings vendors compared.” Updated November 8, 2026. https://thirdpartyriskmanagementsoftware.com/security-ratings/