What Are Security Ratings? How They Are Scored, What They See, and What They Miss
What is a security rating, and why does everyone want one?
The question usually arrives from above. A board member reads about a supplier breach and asks, “What is the security score of our top ten vendors?” Procurement wants a number to put in the vendor scorecard. A business owner wants to know if the new SaaS tool is “rated OK.” Everybody wants one figure that says safe or not safe.
Security ratings exist to meet that need. A security rating is a score, produced by a commercial ratings provider, that summarizes an organization’s externally observable security posture. Providers collect data about a company’s internet-facing assets and related signals, attribute that data to the company, and apply a proprietary model to produce a letter grade or a number on a fixed scale. No access to the rated company’s internal systems is needed, and the rated company does not have to participate.
That is the strength, and it is also the limit. A rating tells you how a vendor looks from the outside, consistently and at scale. It does not tell you how the vendor runs inside, whether its exposure touches your data, or what a failure would cost you. Used as a triage signal, ratings are genuinely useful. Used as the risk decision, they can mislead. This page explains how ratings are built, what they reliably see, what they structurally cannot, and how to use them well.
How are security ratings scored?
Methods differ by provider and are mostly proprietary, but the broad pattern is similar across the market. The US Chamber of Commerce describes it this way in its Principles for Fair and Accurate Security Ratings: rating companies combine data collected or purchased from public and private sources with proprietary algorithms to express an organization’s security effectiveness as a score.
Step 1: Discover and attribute assets
The provider maps the company’s digital footprint: domains, subdomains, IP ranges, and cloud-hosted services. Attribution relies on sources such as DNS records, WHOIS and registrar data, IP registries, and certificates. This step decides everything that follows, because a finding only counts against a company if the asset is attributed to it.
Step 2: Collect signals in risk categories
Common categories include:
- Open ports and exposed services, such as remote desktop, databases, or admin panels reachable from the internet
- Software versions and known vulnerabilities on internet-facing systems
- TLS and certificate configuration
- Email security records (SPF, DKIM, DMARC)
- Web application security headers and cookie settings
- DNS health and configuration
- Observed malware or botnet activity from the company’s IP space
- Leaked credentials and breach history
- Some providers add public information, such as news or regulatory disclosures
Step 3: Weight, normalize, and roll up
Each finding gets a severity and a weight. Many models normalize for company size, so a large enterprise with 50,000 IP addresses is not penalized just for having more surface. Findings often decay over time, so old issues count less. The weighted results roll up into category grades and an overall score.
Step 4: Refresh and publish
Ratings are recalculated as new data arrives, so the score moves over time. Most providers let rated companies see their own rating, and many offer a process to dispute findings and submit corrections.
What do security ratings see well, and what do they miss?
Being fair about ratings means being specific in both directions.
What ratings see well
- Breadth. You can get a consistent view of thousands of vendors without sending a single questionnaire.
- External hygiene. Exposed services, weak email authentication, expired certificates, and unpatched internet-facing software are real, observable, and often correlated with higher incident risk.
- Change over time. A sudden drop is a useful prompt to ask a vendor what happened.
- A common language. A shared score makes it easier to start a conversation with a vendor, especially one that already monitors its own rating.
What ratings structurally miss
- Internal controls. Ratings cannot see whether the vendor enforces MFA on internal systems, tests backups, reviews access quarterly, or has a working incident response plan. Those are often the controls that decide whether an incident becomes a breach.
- Your relationship. Two vendors with the same score can pose very different risk to you, depending on what data they hold and what access they have. A rating is the same for every customer who looks at it.
- Attribution errors. Shared hosting, content delivery networks, divested business units, and old domains can attach findings to the wrong company, or miss assets that do belong to it.
- Impact. Ratings indicate likelihood, not consequence. Forrester made this point directly in its Q2 2024 Wave on cybersecurity risk ratings platforms: a risk rating is not a quantitative measure of risk, it is a score based on indicators that correlate with risk.
- Evidence from the vendor. SOC 2 exceptions, pen test results, and policy commitments sit outside what a scan can observe.
None of this is a flaw in any particular provider. It is the nature of an outside-in measurement. The question is how you combine it with everything else you know.
Why do TPRM programs misuse security ratings?
Most problems come from asking a rating to do a job it was not designed for.
The score becomes the decision
“Approve if B or better” is easy to write into policy and hard to defend in an audit. A vendor with a strong external grade can still hold your most sensitive data with weak internal controls. Ratings should route vendors into the right level of review, not replace the review.
One threshold for every vendor
A single cut-off ignores tier. A moderate score may be fine for a vendor with no data and no access, and unacceptable for one that runs your payroll. Thresholds should vary by tier, as set out in your vendor risk tiering model.
Chasing vendors over findings that are not theirs
When a finding is attributed to the wrong asset and you send it to the vendor as a demand, you spend goodwill and analyst time on a false positive. Check attribution before outreach, and record corrections so the same error does not recur.
Reading the number, not the reason
A score drop from 780 to 720 means nothing on its own. What changed? A new exposed database is urgent. A lapsed certificate on a marketing microsite is not. The underlying findings, not the headline, decide the response.
How should you use security ratings in a TPRM program?
Five rules keep ratings useful without letting them drive the wrong decisions. They also mirror how SAFE TPRM treats outside-in data: as one evidence stream, tied to the vendor’s context, that feeds a broader risk view.
- Use ratings for triage, not approval. Let the external view help decide how deep due diligence goes, and make the decision on the combined evidence.
- Check attribution first. Before acting on a finding, confirm the asset belongs to the vendor and is in scope for your relationship.
- Read findings, not scores. Act on the specific exposure: an exploited vulnerability on a service the vendor exposes to the internet beats a two-point score change every time.
- Combine outside-in with inside-out. Pair the external view with questionnaire answers and evidence such as SOC 2 reports, so each can check the other.
- Set thresholds by tier and act on change. Define what level of external exposure, or what kind of change, triggers a targeted inquiry for each tier, and route material events into a response.
A quick example shows why the rules matter. Two vendors carry similar external grades. Vendor A is a print supplier with no data and no access. Vendor B is a benefits administrator holding employee health and payroll data. Under a single “B or better” policy, both pass. Under the rules above, Vendor A needs nothing more. Vendor B gets a full review, and its SOC 2 report shows an exception on access reviews and a subservice organization that hosts the data. The external grade was accurate. It just could not see the part that mattered most for this relationship.
How is an evidence-based Exposure Score different from a security rating?
A security rating answers “how does this company look from the internet?” SAFE’s Exposure Score answers a different question: “given everything we have observed and collected about this vendor, what residual risk does it carry?” It combines outside-in findings with questionnaire and evidence findings, so a strong external posture does not hide weak internal controls, and a misleading questionnaire answer can be checked against what is visible externally. It sits next to a separate Intake Score, which captures inherent risk from the business context at onboarding, so you can see starting risk and current risk side by side. And analysts can mark wrong asset attributions as exceptions, so findings reflect assets the vendor actually owns.
- 600+ vendors assessed
- 100% completion — zero extra headcount
What breaks when you rely on ratings at scale?
At 200 vendors, an analyst can look behind every score change and check the findings by hand. Ratings work well here as a monitoring prompt.
At 1,000 vendors, score changes arrive daily. If even 10% of vendors move enough to cross a threshold each quarter, that is 100 investigations, each needing attribution checks and a vendor conversation. Teams start reacting to the score itself because there is no time to read the findings, and vendor fatigue sets in when they are asked about issues that are not theirs.
At 5,000 vendors, a score-only approach turns into either alert overload or quiet neglect. What scales is a model where external findings land on the vendor record next to tier, evidence, and open issues, where the system explains what changed, and where analysts can focus on the material changes. SAFE TPRM works that way: outside-in findings feed the evidence-based Exposure Score, “See What Changed” shows which findings moved it, exceptions handle attribution errors once, and findings can become tracked issues with owners and dates. See continuous monitoring for the details.
What are the trade-offs of using security ratings?
Coverage versus depth. Ratings give you broad, low-cost coverage of the entire vendor base. Evidence-based assessment gives you depth on the vendors that matter. You need both, weighted by tier.
Simplicity versus accuracy. A single grade is easy for a board to read and easy to misread. A richer view is harder to summarize but closer to the truth. The answer is to report a simple view, backed by findings and context that anyone can drill into.
Independence versus participation. Ratings do not need the vendor’s cooperation, which is useful. But the most important controls can only be verified with the vendor’s evidence. A program built only on what can be scanned leaves the inside of every vendor unexamined.
SAFE TPRM is designed to reduce these trade-offs rather than pick a side. Outside-in monitoring gives broad coverage across the portfolio. AI-assisted questionnaires and document analysis add depth where tier calls for it, with answers suggested from the vendor’s existing SOC 2, ISO, and policy documents and reviewed by analysts. And where executives need business language, SAFE can express vendor risk in financial terms using the FAIR-MAM model, depending on how your deployment is configured.
Why SAFE TPRM if you already use security ratings?
We do not think security ratings are the enemy. External posture is a real signal, and SAFE TPRM collects it too. We built the platform because teams kept telling us the score was the start of the work, not the end of it. They needed the external view next to the vendor’s tier, evidence, and open issues, with a way to act on it.
What the platform does today:
- Outside-in monitoring. Each vendor’s attributed domains, subdomains, IP addresses, certificates, internet-facing services, vulnerabilities, cloud, DNS, and email-security exposure, plus breach signals, threat intelligence, and dark-web and credential-exposure signals.
- Evidence-based Exposure Score. A residual-risk view that combines outside-in findings with questionnaire and evidence findings, separate from the inherent-risk Intake Score.
- Attribution exceptions. Analysts can correct asset attribution so findings reflect what the vendor actually owns.
- “See What Changed.” An explanation of which findings or parameters moved a vendor’s exposure.
- Evidence intelligence. Document analysis of SOC 2 and ISO reports, with AI-suggested questionnaire answers linked to their sources.
- Findings to remediation. Issues with owners, action plans, and due dates, tracked to closure. See risk assessment.
- Financial context where configured. Vendor risk expressed in business and financial terms using open FAIR standards such as FAIR-CAM and FAIR-MAM.
If your program runs on scores today, see what it looks like when the score comes with evidence and a next step. Watch SAFE TPRM in action or schedule a demo.
Frequently Asked Questions
Security ratings are scores, produced by commercial ratings providers, that summarize an organization's externally observable security posture. Providers discover the company's internet-facing assets, collect signals such as exposed services, vulnerable software, email and TLS configuration, malware observations, and breach history, and apply a proprietary model to produce a grade or number. They require no access to the rated company's internal systems.
They are accurate about what they measure, within the limits of attribution. The main sources of error are assets attributed to the wrong company (shared hosting, CDNs, divested units) and assets that are missed. Ratings also cannot see internal controls, so a good external score does not prove strong internal security. The US Chamber of Commerce's Principles for Fair and Accurate Security Ratings call for transparency, dispute and correction processes, validation, and notice of model changes for this reason.
A security rating is an outside-in score of observable posture, the same for every customer who looks at it. A risk assessment is specific to your relationship: it considers what data and access the vendor has, reviews internal controls and evidence, and ends in a decision. Ratings are a useful input to a risk assessment. See our guide to the vendor risk assessment process.
Not on their own. Ratings can reduce how many vendors need a full questionnaire, and they can flag where to focus questions. But they cannot verify internal controls such as access reviews, backups, or incident response. A more practical goal is to ask fewer, better questions by using external data and existing evidence first. Our article on TPRM without questionnaires explores how far that can go.
SAFE TPRM's Exposure Score is a residual-risk view built from evidence about each vendor. It combines outside-in findings with questionnaire and evidence findings, rather than external signals alone, and it sits next to a separate Intake Score for inherent risk. Analysts can correct wrong asset attributions as exceptions, and "See What Changed" explains which findings moved the score. Where configured, SAFE can also express vendor risk in financial terms.
Look at what changed before contacting the vendor. Confirm the affected asset is attributed correctly and in scope for your relationship. Then judge the specific finding: an exploited vulnerability on an internet-facing service of a critical vendor deserves a targeted inquiry within days, while a minor configuration issue on an unrelated site may only need logging. In SAFE TPRM, "See What Changed" shows the findings behind the move so analysts can make that call quickly.
Usually, yes. Many ratings providers let rated organizations view their own rating and submit corrections, for example to show that an asset was sold or never belonged to them. The US Chamber of Commerce principles say rated organizations should be able to challenge their rating, that disputed ratings should be noted as such until resolved, and that corrected information should be reflected promptly once validated. If a vendor tells you a finding is not theirs, ask for the evidence and record the outcome.
