Security rating
A numerical score assigned to an organization by a vendor from externally observable data, used in underwriting and supplier management, though its correlation with losses remains debated.
A security rating is a score, often on a credit-style scale, that specialist vendors compute for an organization from signals collected without its involvement: configuration of its exposed services, speed of patching, signs of compromised machines talking to malicious servers, email hygiene, credential leaks. Insurers use these ratings as a selection and pricing variable, large companies use them to assess suppliers, and executives use them to track their own posture over time. Their appeal is obvious: they are comparable, continuous and cheap. So are their limits. They measure what is visible from outside, which is only part of the risk. They can misattribute assets, penalize a shared hosting provider or ignore internal compensating controls. And public evidence of their predictive power on losses remains limited, the available studies often coming from the vendors themselves. For the underwriter, a rating is a useful index to combine with others, never a substitute for analysis.
In 2017, the US Chamber of Commerce published, with several rating vendors, principles for fair and accurate security ratings: methodological transparency, the right of the rated organization to dispute and correct data, and accuracy of asset attribution, a sign that rated companies were already challenging the reliability of these scores.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.