Skip to main content
Reporting · An output of the programme

A security rating is an output. The findings underneath it are the work.

The rating summarises what ShadowMap observes on your external estate and attributes every movement to a category, so a board conversation starts from a reason instead of from a number that changed. The work sits one level down: each category opens into the findings that moved it, and those findings are what gets fixed.

Request an exposure snapshot How to evaluate this
0–100
Score, rolled up to an A–F letter grade
One engine
Your estate and your vendors, scored identically
Published
Grade bands and the scoring arithmetic, on this page

What the number is for

A summary is useful precisely because it loses detail

Three jobs a rating does well: it travels into a board pack, it sets a threshold a supplier has to clear, and it draws a trend line long enough to argue with. None of those three is a security outcome.

A score compresses a large amount of observed evidence into one number so that the number can travel. That compression is the entire value, and it is also the entire risk: the score moves for reasons the score does not state. ShadowMap publishes a rating because those three jobs are real and a security team should not have to assemble them by hand each quarter. What it will not do is let the grade stand in for the work. Every category score opens into the findings that produced it: the exposed service, the leaked key, the credential that still authenticates. The finding is where a response actually lives.

The boundary

What a rating can answer, and what it cannot

The first three questions are what a score is genuinely good at. The last three are questions only a finding can answer, so a rating is never where an investigation ends.

The questionRating answers it?What actually answers it
Is this vendor's posture trending down? Yes Score history across the selected period, one line per vendor, with material drift raised as an alert so degradation is visible before the renewal conversation, not during it.
Vendor posture recalculates on the same recurring scan cycle as the rest of the platform, so the trend is continuous, and nobody has to commission a point-in-time reassessment.
Is it above the threshold we set for this tier of supplier? Yes The score itself, against fixed published bands and filterable by grade, by score range and by category, so a policy written as a number can be enforced as one.
A threshold is a commercial control: it decides whether a contract proceeds. What actually gets fixed is decided in the findings.
How does this compare with the rest of our portfolio? Yes Portfolio ranking, and the concentration underneath it: where several of your suppliers sit on the same infrastructure, the same upstream supplier or the same staff, which a vendor-by-vendor view is structurally unable to show.
Eleven suppliers behind one upstream provider carries a concentration risk that eleven unrelated findings do not, and only a portfolio view tells them apart. It is also the exposure a questionnaire programme is least likely to have thought to ask about.
Is there a working credential for this organisation right now? No A stealer-log record carrying an explicit state. Probed where it is safe and authorised: a credential that authenticated says so, and one that was never tested says that too.
A leaked credential might move a category score by a point. The number does not tell you whether it still opens something. Probing runs on the estate you authorise us over, so a vendor-side credential reaches you observed, dated and evidenced, never tested: that authorisation is not yours to give.
Is that exposed key live? No The secret itself with its source, and validation where it is safe and authorised to attempt one. Findings that were not validated are labelled as such.
Detection and validation each carry their own evidence, and a score reflects only the detection.
Has anyone tested it, and can it be removed? No Continuous Automated Red-Teaming carries the verdict, the probe history and the evidence on the finding record. Removal is a takedown request raised from that same finding: unlimited, subject to fair use.
A rating tells you something is wrong. It does not tell you whether it can be used, and it does not remove it.

Is this vendor's posture trending down?

Rating answers it?
Yes
What actually answers it
Score history across the selected period, one line per vendor, with material drift raised as an alert so degradation is visible before the renewal conversation, not during it.

Vendor posture recalculates on the same recurring scan cycle as the rest of the platform, so the trend is continuous, and nobody has to commission a point-in-time reassessment.

Is it above the threshold we set for this tier of supplier?

Rating answers it?
Yes
What actually answers it
The score itself, against fixed published bands and filterable by grade, by score range and by category, so a policy written as a number can be enforced as one.

A threshold is a commercial control: it decides whether a contract proceeds. What actually gets fixed is decided in the findings.

How does this compare with the rest of our portfolio?

Rating answers it?
Yes
What actually answers it
Portfolio ranking, and the concentration underneath it: where several of your suppliers sit on the same infrastructure, the same upstream supplier or the same staff, which a vendor-by-vendor view is structurally unable to show.

Eleven suppliers behind one upstream provider carries a concentration risk that eleven unrelated findings do not, and only a portfolio view tells them apart. It is also the exposure a questionnaire programme is least likely to have thought to ask about.

Is there a working credential for this organisation right now?

Rating answers it?
No
What actually answers it
A stealer-log record carrying an explicit state. Probed where it is safe and authorised: a credential that authenticated says so, and one that was never tested says that too.

A leaked credential might move a category score by a point. The number does not tell you whether it still opens something. Probing runs on the estate you authorise us over, so a vendor-side credential reaches you observed, dated and evidenced, never tested: that authorisation is not yours to give.

Is that exposed key live?

Rating answers it?
No
What actually answers it
The secret itself with its source, and validation where it is safe and authorised to attempt one. Findings that were not validated are labelled as such.

Detection and validation each carry their own evidence, and a score reflects only the detection.

Has anyone tested it, and can it be removed?

Rating answers it?
No
What actually answers it
Continuous Automated Red-Teaming carries the verdict, the probe history and the evidence on the finding record. Removal is a takedown request raised from that same finding: unlimited, subject to fair use.

A rating tells you something is wrong. It does not tell you whether it can be used, and it does not remove it.

The published bands

What each grade means, and what it is legitimately used for

The bands are fixed, and identical on your own estate and on a vendor you have added. We publish what a score means; where the line sits for a tier of supplier is a decision for your policy, not a property of our scale.

What each grade means, and what it is legitimately used for
StateWhat it meansWhat follows
A · 90–100 No material exposure observed in this category on the current scan cycle. Report it. It records what was observable from outside on the current scan cycle.
B · 80–89 Minor observed exposure, none of it severe. Normal remediation queue. The direction of travel matters more here than the value.
C · 70–79 Exposure is present, identified and attributed to a category. Work the findings, not the grade. The distance to a B is a list, and the list is one click under the category.
D · 60–69 Sustained exposure, usually concentrated in one or two categories instead of spread evenly. The proportionate ask of a supplier here is a remediation plan and a re-score date, not a refused renewal.
F · 0–59 Severe or widespread observed exposure. A commercial decision, taken on the findings underneath it. The grade is what sends you to read them.
Key
  • No material observed exposure
  • Observed exposure, identified and attributed
  • Severe or widespread observed exposure

The arithmetic

A grade you can reconstruct is a grade you can dispute

A black-box rating is a letter with no derivation attached, which is how a score turns into a procurement checkbox instead of a work queue. The derivation is below, along with what the method structurally cannot see.

From one finding to a letter grade As of August 2026
  • Every externally observable finding is assigned to a rating category as it is discovered: Vulnerability Management, Network Security, Application Security, Encryption & Certificates, Email & DNS Security, Dark Web & Threat Intelligence, Data Exposure, Brand Protection.
  • Inside a category the score is the geometric mean of its sub-scores, so one badly weak area drags the category down harder than a plain average would permit. Findings are weighted by severity, with critical and high dominating; by recency, so an ageing finding loses weight; and by remediation, so a closed finding stops counting entirely.
  • The overall score is the unweighted mean of the category scores, rounded. There is no inter-category weighting, so a single weak category is diluted by the average and is visible only in the rows. Read the rows for your weakest area and the header for your average.
  • Movement is attributed, not merely reported. Each category carries a plain-language day-over-day delta: "Network Security declined by four points, twelve new findings". Moves below half a point are discarded as noise instead of being drawn as a trend line.
  • Each category carries a ranked list of open recommendations with an estimated score impact, so "what moves this grade" is a list somebody can be handed instead of a question for support.
  • The score recalculates as scans finish, not on a review cycle, and a short server-side cache means everyone in your organisation reads the same number at the same moment. The same engine produces group, subsidiary and business-unit rollups, and benchmarks against up to five peer organisations you select, overall and category by category.

Deliberately excluded

  • The rating sees what is externally observable and nothing else. It says nothing about your internal controls, your policies or your people.
  • The estimated impact on a recommendation is directional. It comes from a different weighting model than the one that produces the grade, and it is published as an indication of order, not a promised movement.

One engine, both sides

The same score on your own estate and on your vendors

A vendor score is computed by the same category engine that produces your own rating: same categories, same arithmetic, same bands. That is what makes an internal target and a supplier threshold comparable numbers instead of two scales that happen to share a letter.

How it gets used

The same engine, seen from three positions

On your own estate
Here the rating is a reporting instrument for something you own and can act on. The board line is the exposure and its direction; the work is the category rows underneath it. Both fall out of the same scan, so nobody has to schedule a quarterly assembly exercise.
On your vendors
Third parties are scored from publicly observable evidence only. They are never contacted, never sent a questionnaire and never asked to participate, so onboarding a supplier costs you nothing but the name. Twenty vendors are included in the base licence, and more can be added.
On the comparison between them
"Our internal target is 85" and "no supplier below 75" become statements on one scale, defensible to an auditor because the methodology did not change when the estate stopped being yours. The drill-down is shared too: a vendor category opens into the breach records, dark-web discussion and phishing pages behind the movement, not into an explanation of the score.

Where this gets sharper

Security Ratings works from one correlated exposure model

Third-Party Risk Management The same score that grades a vendor grades your own estate, computed the same way, so an internal target and a vendor threshold are directly comparable.

Questions buyers ask

Before you evaluate this

Is a good rating the same as being secure?

No, and treating it that way is the single most common misuse of the number. A rating is a summary of what was observed from the outside on a scan cycle; it is very good at travelling into a board pack and very poor at telling you whether a specific credential still authenticates. Use it to report, to set thresholds and to watch a trend. Act on the findings underneath it. The long-form version of this argument, including what a score can and cannot move, is at /blog/what-a-security-rating-does-not-tell-you/.

How does your rating compare with a dedicated ratings platform?

On the score itself, the established ratings vendors have spent a decade on scoring methodology and some hold third-party certification of their attribution. Where a counterparty, insurer or regulator has written a specific vendor’s score into a contract, ours does not substitute for it. What differs is what sits underneath the score. A ratings platform can tell you a supplier looks worse this quarter; it cannot hand you the stealer-log record and the compromised device behind that movement, or the page impersonating that supplier and collecting logins from your customers, and it cannot request that the page come down. On the estate you authorise us over it goes one step further again: Continuous Automated Red-Teaming establishes whether an exposed credential or key opens anything at all, which is a fact no score contains. The question to ask any ratings vendor is what happens after the score.

What if we disagree with a score?

Raise the specific findings with support, not the number. Every category score decomposes into the findings that produced it, so a dispute is always really about a finding: an asset that is not yours, a service decommissioned last quarter, a record attributed to the wrong entity. Resolve the finding and the score follows on the next cycle. The same order applies when one of your own suppliers disputes the score you are holding them to.

Who else does this

How ShadowMap compares

Buyers evaluating security ratings usually have a ratings platform on the shortlist. Those comparisons, with their strengths stated plainly:

ShadowMap vs SecurityScorecard Securing the world’s supply chains Read the comparison → ShadowMap vs UpGuard AI Risk Operations Center Read the comparison → ShadowMap vs RiskRecon A Mastercard Company Read the comparison →

All five vendors side by side · What the same coverage costs if you assemble it from separate tools

See the findings underneath the rating

One apex domain, two business days, a written snapshot. The findings, not a grade.

Request an exposure snapshot See Pricing