Special offer for Diligent customers

Bitsight Security Ratings are a measurement of an organization’s security performance. Much like credit ratings, Bitsight Security Ratings are generated through the analysis of externally observable data. Armed with daily ratings, organizations can proactively identify, quantify and manage cyber security risk throughout their ecosystem.

Unlike existing security assessment tools that examine a company’s policies or conduct periodic scans, Bitsight continuously measures security performance based on evidence of compromised systems, diligence, user behavior, and data breaches to provide an objective, evidence-based measure of performance. This data-driven, outside in approach, requires no information from the rated entity. Bitsight ratings specifically are correlated with financial performance and likelihood of data breaches to help organizations be as informed as possible when managing their cybersecurity.

As the framework for creating the methodology behind our ratings, Bitsight uses the US Chamber of Commerce’s Principles for Fair and Accurate Security Ratings, which we helped develop.

Bitsight Security Ratings range from 250 to 900, with the current achievable range being 300-820. The higher the rating, the more effective the company is in implementing good security practices. Bitsight Security Ratings are calculated using a proprietary algorithm that analyzes and classifies externally observable data. The ratings are generated based on four classes of data -– compromised systems, diligence, user behavior, and data breaches.

For more information on how Bitsight Security Ratings are calculated, download the complete Rating methodology overview.

Security ratings are built on data from over 100 different sources. We collect much of the data ourselves, and we also work with numerous best-in-class data partners (many exclusive) who specialize in various types of telemetry. To date, we have collected petabytes of security relevant data and are adding billions of new observations every day.

For more information on Bitsight’s data collection methods, download the complete Rating methodology overview.

Bitsight believes in the value of cybersecurity ratings because we know they represent more than just what’s happening within your attack surface. Bitsight Security Ratings are independently verified to correlate with data breach risk and stock performance.

Correlation to Data Breach

Bitsight is the only Security Rating Service provider with a third-party validated correlation to breach. As validated by AIR Worldwide and IHS Markit, companies with a Bitsight Security Rating of 500 or lower are almost five times more likely to suffer a breach than those with a rating of 700 or more. For more information about how Bitsight Security Ratings correlate to likelihood of data breach, download this data sheet.

Correlation to Ransomware Event

Bitsight’s research shows that organizations with a rating lower than 600 are 6.4 times more likely to be a ransomware victim compared to organizations with a rating of 750 or higher. Organizations with a rating between 600 and 650 are 4.6 times more likely.

Correlation to Stock Performance

Solactive, a German index engineering firm, found that companies in the top 25% of Bitsight ratings performance outperform the Solactive benchmark index on stock returns by 1% to 7% with lower volatility.

Additionally, IHS Markit found that there is a causal relationship between the company’s cybersecurity readiness – manifested in a higher Bitsight / IHS Markit rank – and their equity performance. Per their research, the 37 highest performers with a top rank of 1 offered more attractive valuation multiples than the 35 businesses that were ranked at the bottom.