About TrustSek
TrustSek scores cyber risk from public evidence, explains every finding, and tells you plainly what it could not check.
Last reviewed
Built to show the evidence behind the score.
Anyone can look at your organisation from the outside: an insurer pricing a policy, a customer vetting a supplier, an attacker picking a target. They see your mail records, your certificates, your exposed services and whether your name appears on a leak site.
A letter grade or a number on its own does not tell you what to fix, or whether the grade rests on evidence at all. TrustSek was built to show the evidence, explain what it means and say how to fix it, so the person who fixes a finding and the person who signs it off read the same thing.
Every score follows the same four rules.
Public evidence only
We score what anyone can observe from the internet. We do not install agents, ask for access or log in to anything. That keeps the method the same for your own domain and for a supplier or a client who has never heard of us.
A published method
The methodology sets out the baseline, the six module weights, how severity and confidence work, and the limits of the approach. Every score records the version of the scoring policy that produced it, so a change to the method is never mistaken for a change in the domain.
Not checked means not checked
When a source fails, times out or is not configured, the result says so. It is never shown as a clean result. You can see which sources answered and which did not, and decide how much weight to give the score.
Explained, not asserted
Every finding carries four things: what was tested, why it matters, the impact and how to fix it. Where a finding maps to a control in NIS2, ISO/IEC 27001, CIS Controls or SOC 2, the mapping is shown. We are careful to say that outside-in evidence supports those frameworks. It does not make anyone compliant.
Built for Sweden and the Nordics first.
TrustSek is built for Sweden and the Nordic countries first. The site is written in Swedish and English, and the compliance work starts from NIS2, the EU directive that sets security requirements for essential and important entities and their supply chains.
We hold our own security to the same standard.
Security explains how we scan, how we handle data and how to report a vulnerability. The privacy policy covers personal data on this site.
Get in touch
Questions about the product, a partnership or the method: contact us or book a demo.