Cybersecurity Posture Scoring

The continuous discovery and monitoring of all internet-facing assets belonging to a supplier. This process identifies shadow IT, exposed databases, and vulnerable services without any internal access.

• Asset Discovery: Automated scanning of IP ranges and domains to map servers, IoT devices, and cloud instances.
• Vulnerability Correlation: Matching discovered services against known Common Vulnerabilities and Exposures (CVEs).
• Misconfiguration Detection: Identifying open ports, expired SSL certificates, and unsecured cloud storage buckets like AWS S3.

The ingestion of dark web, criminal forum, and data leak sources to determine if a supplier's credentials or sensitive data are already circulating among threat actors.

• Credential Exposure: Monitoring for employee email/password combinations linked to the supplier's domain found in combo lists.
• Stealer Log Analysis: Identifying session tokens and credentials harvested by infostealer malware from supplier endpoints.
• Ransomware Leak Site Correlation: Checking if the supplier has appeared on dedicated leak sites operated by ransomware groups like LockBit or ALPHV.

The evaluation of a supplier's externally observable security hygiene, focusing on the proper configuration of core internet protocols and email security standards.

• DMARC/SPF/DKIM Adoption: Assessing the strictness of email authentication policies to prevent spoofing and phishing.
• DNSSEC Validation: Checking if the domain's DNS records are cryptographically signed to prevent cache poisoning.
• HTTPS Enforcement: Verifying proper TLS certificate implementation and automatic HTTP-to-HTTPS redirection across all subdomains.

The measurement of how quickly a supplier remediates known software vulnerabilities. This component tracks the mean time to patch (MTTP) for critical CVEs.

• Version Fingerprinting: Identifying specific software versions of web servers, CMS platforms, and VPN appliances.
• Exploit Availability Mapping: Cross-referencing identified vulnerabilities with public exploit databases like Exploit-DB and Metasploit modules.
• End-of-Life (EOL) Detection: Flagging systems running software no longer receiving security updates, such as outdated Apache Struts or PHP versions.

The analysis of global network telemetry to determine if any IP ranges owned by the supplier are exhibiting malicious behavior or communicating with known command-and-control (C2) infrastructure.

• Sinkhole Traffic Analysis: Detecting beaconing activity from supplier IPs to domains seized by security researchers.
• Spam Trap Hits: Monitoring if supplier mail servers are sending unsolicited bulk email, indicating a potential compromise.
• DDoS Participation: Identifying supplier infrastructure participating in distributed denial-of-service attacks, often without the owner's knowledge.

The final aggregation layer that applies a weighted scoring algorithm to all collected signals, normalizing them into a single, comparable score (e.g., 0-950) or a letter grade (A-F).

• Industry Benchmarking: Comparing the supplier's score against the statistical distribution of peers in the same sector and revenue band.
• Temporal Decay: Applying a decay function to older findings to prioritize recent, active risks over historical, remediated issues.
• Vector Weighting: Assigning higher criticality weights to externally exploitable vulnerabilities (e.g., exposed RDP) over lower-severity configuration warnings.

The continuous discovery, inventory, and monitoring of an organization's internet-facing digital assets to identify exposed vulnerabilities before attackers can exploit them.

• Scans for open ports, unpatched services, and misconfigured cloud storage
• Identifies shadow IT and forgotten subdomains that expand the attack surface
• Maps the full digital footprint including third-party connections and abandoned infrastructure

EASM provides the raw telemetry that feeds into cybersecurity posture scoring models, quantifying how much exploitable terrain a supplier presents to threat actors.

A statistical framework that estimates the likelihood of a data breach occurring within a defined time horizon based on observable security signals and historical incident data.

• Incorporates factors like patch cadence, endpoint hygiene, and credential exposure
• Uses actuarial methods adapted from insurance underwriting to quantify cyber risk
• Outputs a probabilistic score that procurement teams can use for vendor comparison

These models transform raw vulnerability data into forward-looking risk estimates, enabling organizations to prioritize remediation efforts and make data-driven sourcing decisions.

Independent platforms that provide objective, externally verifiable cybersecurity ratings for organizations, analogous to credit ratings for financial health.

• Leading providers include BitSight, SecurityScorecard, and UpGuard
• Ratings are derived from externally observable data without requiring internal access
• Scores typically range from 250-900, with higher values indicating stronger security posture

These services democratize security assessment by providing procurement teams with instant, standardized metrics without needing deep cybersecurity expertise or supplier cooperation.

The automated tracking of publicly reported vulnerabilities and their relevance to a supplier's specific technology stack and software inventory.

• Correlates CVE databases with known supplier infrastructure components
• Monitors exploit availability in the wild to assess active threat levels
• Tracks the time-to-patch metric as a key indicator of security operations maturity

A supplier with a consistently short mean time to remediate critical vulnerabilities demonstrates strong security hygiene, while chronic delays signal systemic process failures.

The monitoring of underground forums, paste sites, and illicit marketplaces for compromised credentials associated with a supplier's domain or employees.

• Detects credential stuffing risks from reused passwords exposed in third-party breaches
• Identifies privileged account compromises that could enable lateral movement
• Provides early warning of impending targeted attacks before they materialize

Credential exposure is a leading indicator of breach risk, as compromised valid credentials remain the most common attack vector for initial access in supply chain intrusions.

The assessment of a supplier's transport layer security configuration, including certificate validity, protocol support, and cipher suite strength across all public-facing services.

• Flags expired or misissued certificates that break encryption trust chains
• Detects support for deprecated protocols like SSLv3 or TLS 1.0
• Evaluates certificate transparency logs for anomalous issuance patterns

Poor certificate management correlates strongly with broader security immaturity, as it indicates a lack of automated asset lifecycle management and operational discipline.