TrustSek as a SecurityScorecard alternative
Both rate an organisation's security from the outside. They differ in what the score looks like, how it is built and what surrounds it. This page sets out those differences from public sources.
Last reviewed
SecurityScorecard is a third-party risk platform.
As described on its website on 27 September 2026, SecurityScorecard is a third-party risk management (TPRM) platform built around what it calls TITAN AI. Its site lists use cases for third-party risk management, security ratings, security questionnaires, self-monitoring, threat intelligence and cyber insurance, and describes its third-party offering as “continuous vendor monitoring, automated assessments, and risk intelligence on one platform”.
Its security ratings use an A to F grading system, with visibility into “10 key categories, including DNS Health, IP Reputation, and Patching Cadence”. Its ratings page describes “an outside-in view of security posture” and an “ML/AI-based scoring approach”, and says its ratings “update continuously”.
TrustSek explains one domain at a time.
TrustSek also works from the outside in. You give it a domain; it collects public evidence and returns a score with every finding explained. No agents, no integrations and no access to your systems.
The score is not a grade. It is a multiplier on a baseline: the scoring policy starts from a 2% chance that an average organisation has a cyber incident in a year, and 1.0× is where a domain with no findings lands. The multiplier falls into one of four bands.
The score is built from six modules with fixed, published weights:
| Module | Weight | What it looks at |
|---|---|---|
| Email securitySPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA, DNSSEC and nameserver redundancy. | 20% | SPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA, DNSSEC and nameserver redundancy. |
| TLS and web hygieneWhether HTTPS is served, certificates, protocol versions and ciphers, redirects, security headers and cookie flags. | 20% | Whether HTTPS is served, certificates, protocol versions and ciphers, redirects, security headers and cookie flags. |
| Ransomware exposureClaims naming the organisation on ransomware leak sites, from two independent trackers. | 20% | Claims naming the organisation on ransomware leak sites, from two independent trackers. |
| ReputationThe domain and its addresses on threat-intel, malware, phishing and botnet lists. | 15% | The domain and its addresses on threat-intel, malware, phishing and botnet lists. |
| VulnerabilitiesAdvertised software versions matched against known-exploited and published vulnerabilities. | 15% | Advertised software versions matched against known-exploited and published vulnerabilities. |
| Attack surfaceSubdomains, high-risk hostnames, open non-web ports, domain age and lookalike domains. | 10% | Subdomains, high-risk hostnames, open non-web ports, domain age and lookalike domains. |
Every finding carries the same four parts: what was tested, why it matters, the impact and how to fix it. A source that could not be checked is shown as not checked, never as a clean result. The whole calculation is on the methodology page, and how it works walks through a scan from start to finish. TrustSek is built for Sweden and the Nordics. The site and the methodology are in Swedish and English; findings in the app are reported in English.
The approaches side by side.
The SecurityScorecard column contains only what its website stated on 27 September 2026. Where it did not say, we do not guess.
| TrustSek | SecurityScorecard | |
|---|---|---|
| What the score looks like | A multiplier on a 2% annual baseline, in four bands | A to F grades |
| How the score is built | Six modules with weights fixed per policy version and published on the methodology page | “10 key categories”; what its ratings page calls an “ML/AI-based scoring approach” |
| Where the evidence comes from | Public sources, plus one TLS handshake and two web requests to the domain; non-intrusive, no port scans | “An outside-in view of security posture” |
| How often it updates | When you run a scan, in about 30 seconds; no monitoring between scans | Ratings “update continuously” |
| Around the score | Supplier tracking, portfolio views, PDF reports, a REST API | TPRM, security questionnaires, threat intelligence and cyber insurance use cases |
| Framework mapping | Findings mapped to NIS2, ISO/IEC 27001:2022, CIS Controls v8 and SOC 2 | Regulatory compliance pages including NIS2, DORA, ISO/IEC 27001 and NIST CSF 2.0 |
| Language and market | Built for Sweden and the Nordics; site and methodology in Swedish and English, findings in English | Not stated in the sources cited |
When TrustSek may fit.
- You want a score you can check line by line, with published weights and a fix for every finding.
- You need to see which evidence is missing before you rely on a number.
- You work in Sweden or the Nordics and want the method explained in Swedish as well as English.
- You need an outside-in view of your own domain or your suppliers' for NIS2 supplier work, a customer or an insurer, without asking anyone for access.
When SecurityScorecard may fit better.
- You need ratings that update continuously, with vendor monitoring between assessments. TrustSek is a scan you run; it does not watch domains between scans or send alerts.
- You want security questionnaires and automated assessment workflows in the same platform as the rating.
- You want threat intelligence alongside third-party risk.
- You prefer a letter grade on an A to F scale.
About this comparison
SecurityScorecard is a trademark of its owner, and TrustSek is not affiliated with SecurityScorecard. Everything said about SecurityScorecard here comes from the public pages listed as sources, as they read on 27 September 2026. We make no claim about its accuracy, prices, customers or quality. If something is out of date, tell us at sales@trustsek.com and we will correct it. Other comparisons are on the compare page.
See how your domain scores
Free, from public evidence. Every finding comes with the reason and the fix.