Security Ratings / Outside-In Risk Scoring
Continuously scores an organization's own external security posture the way a buyer, insurer or acquirer would see it.
Overview
Security-ratings platforms scan the public internet — DNS hygiene, TLS/certificate posture, open ports, leaked credentials, patching cadence, breach history — and reduce it to a single score and letter grade: the same view a customer, cyber-insurance underwriter or acquirer already runs against you before ever making contact. Distinct from third-party vendor risk (which buys these same scores to rate SUPPLIERS, see `third-party-vendor-risk-tprm`) and from attack-surface management (which inventories assets rather than scoring them, see `attack-surface-management-asm`): this area is about running that outside-in lens against your OWN domain and acting on it before a buyer sees a surprise. Vendors here rescore continuously and are mostly sales-gated; published list prices are the exception (UpGuard lists one entry plan).
A rating a buyer, insurer or acquirer already runs against you is worth seeing first — and acting on — rather than finding out about mid-deal.
Advantages
- Shows the exact external view a prospect's security team, cyber-insurance underwriter or acquirer's diligence team already sees, before they raise it
- Continuous daily/weekly rescoring catches drift — an expiring cert, a newly open port — between formal audits
- A rising trend line is evidence to hand a customer or the board, not just a point-in-time claim
Trade-offs
- Scoring models are proprietary and differ in scale and weighting; the same domain can score differently on two platforms
- Scores are entirely passive/outside-in — they never see compensating internal controls, so a well-defended org can still show a mediocre score
- Mostly sales-gated, quote-only pricing scaled to subsidiary/domain count
Open-source option
An internet-scale, continuously-updated outside-in scoring engine depends on proprietary scan infrastructure, historical breach-correlation data and a maintained scoring model — none of which has a credible self-hostable open-source equivalent. `ip-reputation-threat-feeds` and `dns-email-auth-posture` in this same domain cover the free/open building blocks (DNSBLs, DMARC/SPF tooling) a rating platform partly scores on.
Vendors & tools in this area
A–F letter-grade security rating across 10 risk-factor groups.
Visit site →250–900 point security rating (vendor-stated achievable range roughly 300–820), used in cyber-insurance underwriting.
Visit site →Rating out of 950, blending automated scanning with questionnaire evidence; offers a free instant self-score.
Visit site →Cyber-risk ratings from a Mastercard company, with per-asset finding breakdowns.
Visit site →Standards-based rating across technical, financial and compliance angles, with named-incident tagging.
Visit site →Computes its own explainable outside-in score (0-100, A-F) for your OWN verified org from DNS/TLS/IP/exposure findings, and shows your existing SecurityScorecard/Bitsight rating beside it — still rates only your own organization, not third parties.
Visit site →