What is a security rating?
A security rating scores an organisation's cybersecurity from what anyone can observe on the internet. Here is how ratings are built, how the scales differ, and where they stop.
By the TrustSek editorial team · Last reviewed
- Topic
- Security ratings
- Access needed
- None
- Method
- Public evidence
A security rating is an outside-in score.
A security rating, sometimes called a cyber risk score, condenses what can be seen of an organisation's security from the internet into one number or grade. It is built without the organisation's involvement: no access to its systems, no software installed, no questionnaire. That is what makes ratings useful when you need to assess someone you do not control, such as a supplier, a client or a company applying for cyber insurance.
Because nobody has to cooperate, a rating can be produced in advance, for many organisations, and repeated whenever it is needed. The trade-off is that it only sees what is visible from the outside.
What goes into one.
Ratings read the same kinds of public evidence, even if each provider weighs them differently:
- Email security: whether SPF, DKIM and DMARC protect the domain against spoofing. See email security.
- Encryption and web configuration: certificates, TLS versions, HTTPS redirects and security headers. See TLS and web security.
- Software versions: public services that advertise versions with known vulnerabilities. See vulnerabilities.
- Exposure: subdomains, open ports and lookalike domains. See attack surface.
- Reputation: whether the domain or its IP addresses appear on malware, phishing or botnet lists. See domain reputation.
- Incident signals: for example a claim on a ransomware leak site. See ransomware exposure.
The scales differ from provider to provider.
There is no common standard. As described on the providers' own websites on 27 September 2026:
| Scale | How the number is built | |
|---|---|---|
| SecurityScorecard | A to F | Grades across ten categories, including DNS health, IP reputation and patching cadence |
| Bitsight | 250 to 900 | A higher number means stronger performance; risk vectors grouped into four weighted categories |
| UpGuard | 0 to 950, graded A to F | Starts at 950 and loses points for each failed check, by severity and weight |
| TrustSek | A risk multiplier | Each finding adds risk to a 2% annual incident baseline; 1.0× is a domain with no findings |
A 700 on one scale says nothing about a B on another, so compare organisations on the same scale, and read what is behind the number. The comparisons go through each provider in more detail, with sources.
What a rating can tell you.
- Hygiene that shows from the outside. Missing DMARC, an expired certificate or an outdated web server are facts, not opinions, and they are often the same weaknesses attackers check first.
- Concrete questions to ask. “Your mail domain publishes no DMARC policy” gets a faster and more honest answer from a supplier than a generic questionnaire item.
- Change over time. The same rating run again after a fix shows whether the fix is visible from the outside.
- A starting point when you have nothing else. Before a supplier answers a questionnaire, or before an insurer asks, a rating shows what is already public.
What it cannot tell you.
- Anything inside the organisation. Backups, incident handling, access control, staff training and internal multi-factor authentication do not show from the internet, and they are most of what standards such as NIS2 and ISO 27001 ask for.
- Proof of security. A clean result means nothing visible was found. It is not evidence that the organisation is secure, and a poor result is not proof that it has been breached.
- Ownership with certainty. A rating has to decide which domains, addresses and services belong to the organisation. Shared hosting, cloud platforms and content delivery networks make that harder, so check that each finding concerns an asset the organisation actually runs.
- What happens between readings. A rating describes what was visible when it was produced.
How to use one well.
- Read the findings, not only the number. A score without its findings cannot be acted on or challenged.
- Check the evidence behind each finding. Is the asset theirs, and is the finding still true today?
- Use it to open a conversation, not to close one. Ask the supplier about specific findings, and accept evidence that a finding is wrong or already fixed.
- Keep the dated result with the assessment it supports, and run it again when a contract is renewed or a supplier's role changes.
- Rate yourself first. Your customers, insurers and attackers can see the same evidence.
TrustSek shows every finding behind its score, says how it was tested and how to fix it, and marks evidence it could not collect as not checked instead of guessing. The methodology explains exactly how findings become the score.
See your own domain's rating
Check your domain, or a supplier's, and see every finding behind the score.