trust.securityscorecard.com Open in urlscan Pro
18.217.122.90  Public Scan

Form analysis
0 forms found in the DOM

Text Content

FAQ Create Free Account


TRUST BEGINS WITH TRANSPARENCY.

We invite you to take an inside look at the data that drives our technology.

For full transparency, we documented and made public our methodology and
formulas that calculate our scores. Learn about it in our Scoring Methodology
whitepaper.

Read Whitepaper

SecurityScorecard commissioned a team of independent pentest experts to audit a
sample of scorecards to objectively determine the accuracy of our IP and domain
attribution.

Read Report


THE PURPOSE OF
THIS SITE

Our goal is to provide transparency into our ratings methodology and deliver
insights into how it aligns with industry standards.

Security rating companies use a combination of data points collected organically
or purchased from public and private sources, and then apply proprietary
algorithms to articulate an organization’s security effectiveness into a
quantifiable score. Here we show the quality, breadth, and measurements of our
data and its sources.

View FAQ


A SECURITY RATINGS TOOL
FOR THE ENTIRE TEAM

 * Transparency
 * Model Governance
 * Dispute, Correction
   and Appeal
 * Independence
 * Accuracy and
   Validation
 * Confidentiality

Learn more about these principles adopted by the US Chamber of Commerce and
supported by organizations across the globe as guidelines for fair and accurate
security ratings.


DATA COLLECTION

With millions of companies scored, the depth and scope of our collected data is
unmatched, and our ability to validate our data increases with every new
customer and follower.

These numbers are updated in real time, and illustrate the expansive reach of
our scoring and monitoring.

12,102,965

Companies Rated

864,079

Unique Companies Followed

2,034

Users Logged Into The Platform Today


DISPUTE, CORRECTION, AND APPEAL

According to the principle, dispute, correction and appeal, rated organizations
shall have the right to challenge their rating and provide corrected or
clarifying data.

Companies can dispute any finding associated with their company score using one
of three resolution types:

 * 1
   
   
   DISPUTE
   
   The identified risk/finding was incorrectly associated with the company and
   should be removed from the company’s record/score.
 * 2
   
   
   CORRECTION
   
   The company provides clarifying data about a compensating control in place
   that is not visible to our non-intrusive, outside-in view of the company.
 * 3
   
   
   APPEAL
   
   The company resolved the risk.


REFUTE RATE (TRAILING 7 DAYS)

Jun 21, 2022Jun 22, 2022Jun 23, 2022Jun 24, 2022Jun 25, 2022Jun 26, 2022Jun 27,
2022Rate in Percentage0%00.10.20.30.40.50.60.70.80.91Rate


Companies have the option to submit refutes with evidence where the findings are
mitigated by internal compensating controls or the organization believes the
findings to be incorrect. The daily rate of such refutes (7-day trailing
average) is typically less than a few percent of the reported findings.


REFUTE RESPONSE TIME (TRAILING 7 DAYS)

Jun 23, 2022Jun 24, 2022Jun 25, 2022Jun 26, 2022Jun 27, 2022Jun 28, 2022Jun 29,
2022Hours-10123456789101100.10.20.30.40.50.60.70.80.91Average Response Time in
Hours


SecurityScorecard engages collaboratively with its users and maintains a
response time for resolving customer-submitted refutes that is well within the
48-hour SLA. The chart shows the 7-day trailing average of recent daily response
time in hours.


TRANSPARENCY

Our customers have access to the greatest volume and quality of intelligence
available.

SecurityScorecard leverages data mined with the market’s leading capabilities,
and relies on a global network of sensors to monitor signals across the
internet.

We enrich our data using commercial and open-source intelligence sources, and
track over 79 security issues.


NUMBER OF SECURITY ISSUES DISCOVERED

27,843,527,140

So Far This Week

114,999,670,635

Week of Jun 26th

118,369,722,185

Week of Jun 19th

100,225,655,719

Week of Jun 12th

91,828,104,943

Week of Jun 5th


INCIDENCE OF CYBERSECURITY
FLAW VS. DIGITAL FOOTPRINT

The number of findings for exposed Microsoft's Remote Desktop Protocol (RDP)
service vs. the number of IPs (size of digital footprint).

SecurityScorecard monitors the cybersecurity posture of millions of
organizations. Among organizations with this issue, the dashed blue line
corresponds to the average incidence (no. of findings). For example, an
organization with 106 IPs (i.e. 1,000,000 IPs) typically has about 102 (i.e.
100) findings for exposed RDP service.

Each blue dot corresponds to a scored company. Organizations in the yellow band
receive an average score. Companies in the green region (fewer than average
findings) receive a better score, while those in the red region (worse than
average findings) receive a worse score.

Hover over the graph to see how the distribution of findings among comparably
sized organizations (gray vertical band) varies with company size.

SecurityScorecard’s scoring algorithm is based on a principled statistical
framework.

One of the biggest challenges to providing fair cybersecurity ratings is
properly accounting for company size. Attack surface typically scales with
digital footprint, which ranges from a single IP for a small company to hundreds
of millions of IPs for a large tech firm. To level the playing field,
SecurityScorecard measures how the incidence of cybersecurity flaws (i.e. number
of issue findings) varies with company size, and evaluates companies compared to
organizations of similar size.


A DEEP DIVE IN SCORING METHODOLOGY

SecurityScorecard scores provide insights and a detailed analysis of the
security posture of an organization. Take a deep dive into our scoring
methodology.

Download



ACCURACY & VALIDATION


IP MISATTRIBUTION -
REFUTE RATE

Jun 20, 2022Jun 21, 2022Jun 22, 2022Jun 23, 2022Jun 24, 2022Jun 25, 2022Jun 26,
2022Rate in Percentage0%1%1.5%2%00.10.20.30.40.50.60.70.80.91Rate


SecurityScorecard reports a low False Positive error rate for IP attribution
based user-submitted refutes. The chart shows a 7-day trailing average of recent
data.


DOMAIN MISATTRIBUTION -
REFUTE RATE

Jun 19, 2022Jun 20, 2022Jun 21, 2022Jun 22, 2022Jun 23, 2022Jun 24, 2022Jun 26,
2022Rate in Percentage0%4%6%8%10%12%14%00.10.20.30.40.50.60.70.80.91Rate


SecurityScorecard reports a low False Positive error rate for domain attribution
based user-submitted refutes. The chart shows a 7-day trailing average of recent
data.

Weeks01234567891011121314Score01234567800.10.20.30.40.50.60.70.80.91Engaged
VendorsUnengaged Vendors



SCORE IMPROVEMENTS FOR ENGAGED SUPPLY CHAIN VENDORS

Companies that use SecurityScorecard to engage their supply chain see a
quantifiable improvement in their ecosystem security posture.

Rated companies that are invited to the platform with low security grades (C, D,
or F) typically exhibit on average a 7 to 8 point improvement within 3 months,
while the average score of unengaged companies remains relatively unchanged over
the same period.


MODEL GOVERNANCE

SecurityScorecard grades the cybersecurity health of organizations based on the
information collected by ThreatMarket, our proprietary data engine, as well as
our own internal collection activities. ThreatMarket collects information from
several sources like data feeds, sensors, honeypots, and sinkholes. Both methods
collect data that is externally accessible and public, meaning no intrusive
techniques are used to gather the information. This comprehensive swath of data
is then analyzed and appropriately weighted by considering factors such as the
severity of the issues, the risk level as defined by industry standards, the
overall performance of similar companies, and so on.


HOW CHANGES TO SCORING METHODOLOGY ARE COMMUNICATED

SecurityScorecard’s approach is to actively communicate substantive platform
changes to customers using the appropriate methods of communication based on the
update. This may include, for example:

 * Customer success representatives providing updates to customers via email.
 * In platform pop-ups alerting customers to updates upon login.
 * Whitepapers explaining scoring methodologies.


INDEPENDENCE

SecurityScorecard’s ratings are fully independent and free of any commercial
bias. To facilitate a fair, consistent and meaningful evaluation of
cybersecurity risk, SecurityScorecard uses robust statistical methods to
evaluate the security posture of a company compared to others of similar size.
SecurityScorecard determines a company’s size by the number of digital assets
assigned to the company. Aligning ratings for every company based on size
ensures that companies are compared apples-to-apples, and that commercial
agreements with SecurityScorecard do not influence ratings.

SecurityScorecard provides the ability for any rated company to view their
company’s scorecard. A companion article titled SecurityScorecard on the
Principles for Fair & Accurate Security Ratings: A Focus on Dispute, Correction,
and Appeal provides additional detail on the topic of how a company can
challenge a rating.


CONFIDENTIALITY

Confidentiality: All information disclosed during a rating challenge or dispute
is protected according to Confidentiality terms documented in the
SecurityScorecard Master Service Agreement.

SecurityScorecard is committed to providing ratings for companies that is based
solely on publicly and ethically sourced data. In principle, the rating data
provided by SecurityScorecard is already in the public domain. SecurityScorecard
recognizes the sensitivity of the data represented in our rating system and
works diligently to protected sensitive data from public disclosure. Efforts to
protect information include information security controls within the platform
and SecurityScorecard’s online footprint itself.

SecurityScorecard data is only available to users that have properly registered
for access to our platform information. Any user that wishes to view the
scorecard for their own company must go through a formal user onboarding process
that ensures the user is an employee of the company they claim to represent. In
addition, companies that license the service must adhere to contractual
obligations that dictate the use of ratings they access with respect to their
vendors, to ensure the information is not used to compromise the systems of
another third party.


HAVE QUESTIONS?

Contact Us
 * Content Security Policy (CSP) Missing
 * Open DNS Resolver Detected
 * Malformed SPF Record
 * SPF Record Contains a Softfail
 * SPF Record Contains Wildcard
 * DDoS Protection Service Detected
 * Content Security Policy Contains 'unsafe-*' Directive
 * Content Security Policy Contains Broad Directives
 * Unsafe Implementation Of Subresource Integrity
 * Domain Uses HSTS Preloading
 * Unsolicited Commercial Email
 * Possible Typosquat Domains Detected
 * Outdated Operating System Observed
 * Site does not enforce HTTPS
 * Website Does Not Implement HSTS Best Practices
 * FTP Service Observed
 * IMAP Service Observed
 * Microsoft SQL Server Service Observed
 * MySQL Service Observed
 * POP3 Service Observed
 * PostgreSQL Service Observed
 * RDP Service Observed
 * Redis Service Observed
 * rsync Service Observed

 * Transparency
 * Model Governance
 * Dispute, Correction and Appeal
 * Independence
 * Accuracy and Validation
 * Confidentiality