Bitsight Security Ratings

Bitsight Security Ratings are data-driven scores, ranging from 250 to 900, that measure an organization's cybersecurity performance from the outside in. Bitsight, founded in 2011, is one of the most widely used providers of security ratings, and its scores are used by insurers, investors, regulators and procurement teams.

Ratings are calculated daily from externally observable evidence, including compromised systems such as botnet infections, security diligence factors like open ports, patching cadence, TLS and email security configuration, user behavior such as file sharing, and public disclosures of breaches. Because no access to the rated company's network is required, organizations can assess themselves and any third party in the same way. Bitsight maps internet assets to organizations, lets rated companies dispute or correct findings, and has published research correlating lower ratings with higher breach likelihood. Ratings feed Bitsight's third-party risk, security performance and cyber insurance products.

Companies use Bitsight Security Ratings to benchmark security, assess vendors, inform cyber insurance underwriting and track risk in investment portfolios.