SecurityScorecard, Inc. is an American cybersecurity company specializing in security posture ratings and third-party risk management. Based in New York, it turns external technical observations into indicators for security teams, risk managers and procurement professionals. Its website, securityscorecard.com, presents a platform designed to monitor the digital exposure of an organization and its ecosystem.
A company born out of the need to measure risk
SecurityScorecard was founded in 2013 by Aleksandr Yampolskiy and Sam Kassoumeh, two information security professionals. Their starting point: businesses rely on numerous service providers but rarely have a consistent, up-to-date view of their level of protection. Questionnaires and periodic audits remain useful, but do not always reflect changes occurring between assessments.
The company developed around a complementary approach: observing technical traces accessible from the Internet to produce assessments updated over time. This positioning places SecurityScorecard in the cybersecurity ratings market, at the intersection of threat intelligence, supplier management and risk management.
From technical signals to operational decisions
The platform analyzes elements relating to network security, the configuration of exposed services and the presence of signals associated with malicious activity, among other things. It seeks to link these observations to the digital assets of the organizations being assessed, then summarizes them as scores and grades ranging from A to F. The aim is to make complex technical situations comparable and guide investigations.
For a customer, use cases include assessing a supplier before selection, monitoring a portfolio of partners and tracking its own external attack surface. Dashboards, alerts and integration interfaces allow this information to be incorporated into risk management processes. The platform also facilitates dialogue with an assessed organization to examine findings and track corrective actions.
This outside view does, however, have limitations. A rating is neither a comprehensive audit of internal systems nor a guarantee against an intrusion. The relevance of the results depends in particular on asset attribution and the contextualization of observations. These indicators are therefore best considered alongside internal controls, audits and discussions with suppliers.
What’s next?
Dependence on digital services and regulatory attention to subcontracting chains create a favorable environment for continuous third-party monitoring. For SecurityScorecard, the challenge is to connect measurement more closely to action: helping prioritize risks, document remediation efforts and verify their impact. Trust in ratings will also remain crucial, with high expectations for score explainability, data quality and the ability to correct erroneous asset attribution.