What’s changing with the 2025 RAU?
This year’s RAU consists of four major changes.
1. Web Application risk vector: Web Application Security risk vector will now impact ratings, replacing the 5% weight of Web Application Headers in the overall rating.This shift will modernize the algorithm by providing a more comprehensive way to measure how well an organization’s web applications adhere to application security best practices. As a part of the Diligence risk category of the Bitsight security rating, this risk vector looks for findings about web applications in line with the OWASP Top 10. These include using components with known vulnerabilities, broken authentication and access control, sensitive data exposure, absence of cross-site scripting prevention mechanisms, and security misconfigurations.
2. Decreasing the time period on findings with insufficient data or no data: If the only finding for a risk vector expires, Bitsight currently uses that finding for up to 400 days past the finding expiration date. This will decrease to 340 days with RAU25, ensuring that those findings will always be visible to users.
3. Clarifying the path to perfect on risk vector grades: In an effort to level up the transparency of Bitsight ratings, we’re now providing greater visibility into the number of positive findings associated with establishing a perfect risk vector grade for certain risk vectors. For some risk vectors, Bitsight applies a minor downgrading to companies with low findings counts, whether or not there are negative findings. This is designed to reflect uncertainty in the score due to the low finding count. The amount to be downgraded will be determined based on the finding count as opposed to the current method where it is determined relative to other organizations. This added visibility will help companies understand how to achieve their goal of obtaining perfect ‘A’ grades for the critical Open Ports, TLS/SSL Configurations, TLS/SSL Certificates, and Server Software risk vectors.
4. Ratings drop prevention: This update ensures that ratings drops for certain risk vectors will not occur if there are no negative findings for those vectors. It will also ensure that a rating will remain stable if an organization only has positive finding grades for certain risk vectors.
You can also find more information in the Bitsight Knowledge Base.
How to understand RAU25’s impact on your organization’s rating
Starting on April 8th, you can preview your organization’s current rating compared to what it may look like in the future using the new algorithm. This will help your organization begin to understand how these updates will impact your rating and to start planning remediations in advance of the changes, as well as to communicate with your stakeholders about any expected changes.
The preview dashboard will be updated weekly for the next three months until the 2025 RAU is implemented in July.
What’s driving this year’s update?
As with previous RAUs, this latest update is driven by our published principles for fair and accurate security ratings. Transparency, accuracy and validation, and model governance are some of the important principled themes driving the changes in the 2025 RAU.
Specifically with regard to the ratings-impacting changes around web application security, we endeavored to telegraph our intentions by making these findings visible even before they were used as part of the overall ratings calculation. Many companies that depend on Bitsight ratings have been asking for a more comprehensive measure that evolves the value of the Web Application Headers risk vector. Leveraging the OWASP framework, our Bitsight security researchers helped guide how we collected and measured the data signals that went into the Web Application Security Risk vector.
“Our approach to web application security metrics involves leveraging the OWASP Top 10 as a foundation for our assessments,” explained Pedro Umbelino, principal research scientist at Bitsight, in a recent deep dive into the newly ratings-impactful risk vector. “These assessments are meticulous, providing detailed forensic data and tailored remediation strategies for identified vulnerabilities.”
At the same time, the other three changes in this RAU were very much brought together under the number one principle of transparency. Our biggest goal of this update was to maximize the visibility and understanding about what it takes to achieve the highest possible Bitsight rating. We believe that Bitsight customers and the broader security community will benefit greatly from these changes and see this as a sign of Bitsight’s commitment to listening to risk leaders’ needs and bringing about actionable cyber risk intelligence in order to successfully measure and manage cyber risk in 2025.
Learn more about the Bitsight Security Rating
If you would like to learn more about how the Bitsight Security Rating works and view examples of its correlation with real-world cybersecurity outcomes, be sure to visit our security ratings overview page.
