Our A–F cybersecurity rating gives organizations and their stakeholders an objective, real-time measure of security posture — based on 250+ data points across 6 critical risk categories.
Our A–F scale gives you an instantly understandable measure of security maturity — the same way academic grades communicate performance.
Organization demonstrates strong security controls across all categories with minimal exploitable vulnerabilities. Continuous monitoring is active and patching is timely. Sets the benchmark for the industry.
Most security controls are in place with only a few medium-severity gaps. Organization has a sound security foundation but has some known areas that need attention. Low breach risk compared to industry peers.
Basic security controls exist but multiple high-severity vulnerabilities are present. The organization is meeting minimum standards but is susceptible to targeted attacks and may face compliance challenges.
Critical vulnerabilities are present with inadequate controls across multiple categories. Organization is at elevated risk of a breach and likely failing compliance requirements. Immediate action is strongly advised.
Severe, exploitable vulnerabilities across most or all categories with virtually no effective security controls. The organization faces near-certain risk of a serious breach and urgent expert intervention is required immediately.
Every rating is calculated from a weighted combination of six critical security categories — each analyzed using a combination of automated scanning and expert analyst review.
Analysis of open ports, exposed services, firewall configuration, network segmentation, and external attack surface exposure.
Web application vulnerability assessment including OWASP Top 10 checks, header security, content policies, and known CVE exposure.
Evaluation of data encryption practices, credential exposure in public breach databases, and sensitive data handling signals.
Domain configuration security including DNSSEC validation, DNS hijacking resistance, registrar lock status, and zone transfer vulnerabilities.
Assessment of email authentication protocols that prevent phishing, spoofing, and business email compromise (BEC) attacks.
Analysis of software currency and vulnerability remediation speed — how quickly known vulnerabilities are patched relative to industry standards.
All data is collected from publicly available signals — no system access, no agents, no credentials required. We analyze what the internet sees about your organization.
All data collection is passive and external — we never require credentials, VPN access, software installs, or any form of privileged access to your systems.
Security ratings aren't just for CISOs. Here's how different teams and organizations put their rating to work.
Use your rating as an objective, board-ready KPI for security program performance. Track improvements over time and prioritize remediation based on risk severity scores.
Look up the security ratings of any vendor before signing a contract. Make data-driven procurement decisions and reduce third-party supply chain risk.
Use objective security ratings to inform underwriting decisions, set premium pricing, and monitor policyholder risk changes throughout the policy term.
Demonstrate security diligence to regulators and auditors with a third-party verified security rating. Satisfy SOC 2, HIPAA, and GDPR vendor assessment requirements.
Differentiate from competitors by sharing your verified A or B rating with enterprise prospects. Win deals faster by proactively proving your security posture.
Deliver continuous security ratings to your clients as a managed service. Use rating data to upsell remediation, justify security investments, and prove program ROI.
Everything you need to know about how our ratings work.
Our ratings are highly accurate because they combine automated external scanning with certified analyst review. Every automated finding is validated by a human before contributing to the final score, removing false positives and ensuring context-appropriate risk assessment. We continuously improve our models based on feedback and real-world breach correlation data.
Some improvements are near-instant — fixing a missing DMARC record or renewing an SSL certificate can boost your score within 24 hours. More complex improvements like patching vulnerable software or redesigning network architecture take longer. Our clients typically see a full letter grade improvement within 30–60 days of beginning active remediation.
Yes. All paid subscribers have access to a dispute process where you can submit evidence that a finding is a false positive or has been remediated. Our analyst team reviews disputes within 3–5 business days and updates your score if warranted. We take accuracy seriously and welcome corrections that improve our data quality.
Basic rating summaries (letter grade and industry tier) for rated organizations are available in our searchable database for premium subscribers. Full reports with detailed vulnerability findings are never publicly disclosed — they are only shared with the rated organization or authorized subscribers with a permissible purpose.
A penetration test is a point-in-time, deep-dive attack simulation that requires system access and typically costs $10,000–$50,000+. Our cybersecurity rating is a continuous, external, non-intrusive assessment that provides an ongoing security posture score at a fraction of the cost. Many organizations use ratings for continuous monitoring and use penetration tests for periodic deep validation — they complement each other.
Find out in 48 hours with a free assessment from America's most trusted cybersecurity rating platform. No system access needed, no credit card required.