Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Use Vendor Security Ratings to Assess Third-Party Risk
Transcript
- Lucas: So you're about to sign a contract with a new cloud storage vendor. Their sales deck says they're SOC 2 compliant, they've got encryption at rest and in transit, the whole thing looks solid. But here's the question: how do you actually know they're secure right now, not just during the audit window? Luna: Right — the audit is a snapshot, not a live feed. And we've seen too many breaches where the vendor's security posture degraded months after the contract was signed. Lucas: Exactly. That's why more enterprises are turning to vendor security ratings — basically a credit score for cybersecurity. Firms like SecurityScorecard and BitSight grade vendors on an a to f scale based on continuous external scanning, breach history, and even user behavior data. And these ratings are starting to carry real weight in procurement decisions. Luna: I've heard about those. But how reliable are they? I mean, a letter grade seems pretty reductive for something as complex as security posture. Lucas: It's a fair point. The ratings are based on a few key factors: patching cadence, open ports, encryption standards, whether the vendor's domain is associated with known malicious activity, and things like that. They're not perfect. A small vendor can get dinged for an open port that's not actually exploitable. But the trend is clear — 63 percent of data breaches now originate through third-party vendors, according to a 2025 study from the Ponemon Institute. So companies need some kind of scalable signal. Luna: 63 percent. That's huge. So these ratings are basically a way to filter the noise before you even start a deeper assessment. Lucas: Exactly. Let me give you a concrete example. A mid-sized regional bank I spoke with — let's call them Coastal Trust — was evaluating a file-sharing vendor. The vendor had decent marketing materials, but a quick SecurityScorecard check showed a C rating. The main issue: the vendor had a misconfigured S3 bucket and an outdated SSL certificate. Neither was actively exploited, but it signaled sloppy operational security. Coastal Trust used that C rating to push for a remediation clause in the contract, requiring the vendor to fix both issues within 30 days or face a 15 percent fee reduction. The vendor fixed them in three weeks. The bank estimated that doing that upfront saved them about two point three million dollars in potential breach costs down the line. Luna: That's a really smart use of the rating — not to kill the deal, but to drive better behavior. It's like using the score as leverage instead of just a gate. Lucas: Right. And that's the mature approach. The ratings themselves aren't the whole story, but they give procurement teams a data point to start a conversation. And increasingly, cyber insurance carriers are looking at these ratings too. If your vendor has a D or F, you might not even get coverage for a breach originating from them. Luna: So it's not just about risk management — it's also about insurance eligibility. That changes the calculus for a lot of companies. Lucas: Exactly. And the ratings are becoming more transparent about how they're calculated. BitSight, for example, uses a combination of publicly available data — like scan data from Shodan — and proprietary data from partnerships with ISPs. SecurityScorecard adds in things like user behavior analytics, looking for patterns that suggest compromised credentials. Neither platform reveals their exact algorithm, which is a source of some criticism, but they do publish general methodology documents. Luna: I can see why some vendors push back. If you're a small SaaS company and you get a C because your firewall logs show an outdated rule, that could cost you a deal. And the rating agency is essentially an unregulated arbiter. Lucas: That's the tension. There have been cases where a vendor got a low rating due to a false positive — like a scanner flagging a test server that wasn't even in production. The vendor had no easy way to appeal. So the industry is still working on accuracy and fairness. But the overall direction is clear: companies want continuous, objective data on their vendors, not just a PDF from last year's audit. Luna: Yeah, and I think that's the key shift. It's moving from trust but verify to verify continuously. And these ratings are the most practical tool for that at scale. Lucas: Quick honest thing — if these conversations are useful for what you're building or running, a handful of listeners chip in monthly through buy me a coffee dot com slash fexingo, and that's literally what funds making this many of these episodes. No ads, no sponsors, just listener support. It's a small group already, but it makes a big difference. Luna: Yeah, it really does. Keeps us free to dig into the topics that matter without any outside pressure. And we appreciate everyone who's part of that. Lucas: So back to vendor ratings — one area where they're having a big impact is in M&A due diligence. When a company is being acquired, the buyer's security team often runs a rating on the target. I've seen deals where a poor rating led to a lower purchase price or a requirement to fix security gaps before closing. Luna: Interesting. So it's not just ongoing vendor management — it's also a deal-breaker tool in M&A. Do you have a recent example? Lucas: There was a case last year where a private equity firm was acquiring a mid-market logistics company. The due diligence included a BitSight scan that showed the logistics company had a high number of devices with known vulnerabilities — things like unpatched VPNs and outdated firmware. The PE firm used that to negotiate a seven percent reduction in the purchase price, which worked out to about $14 million. They also required the logistics company to remediate the vulnerabilities within six months post-close, with a clawback provision if they didn't. Luna: Seven percent. That's significant. And it shows how these ratings are moving from a nice to have to a standard part of the deal playbook. Lucas: Absolutely. And it's not just private equity. Public companies are starting to disclose vendor rating data in their ESG reports. For instance, a large retailer I follow now includes its average vendor security rating in its annual sustainability report, alongside carbon emissions and diversity metrics. They see it as a measure of operational resilience. Luna: That's a fascinating intersection — security as an ESG metric. I hadn't thought of it that way. But it makes sense. Investors increasingly care about cyber risk as a board-level issue. Lucas: Right. And the ratings platforms are responding. SecurityScorecard now offers a feature that lets companies benchmark their vendor portfolio against industry peers. So if you're a bank, you can see how your average vendor rating compares to other banks. That creates competitive pressure to improve. Luna: Which is good for everyone, as long as the ratings are accurate. But we should talk about the flip side: what happens when a vendor gets unfairly downgraded and loses business? Is there any recourse? Lucas: It's a real problem. There's no formal appeal process like with credit bureaus. But some vendors have started pushing back publicly. In 2024, a small cloud hosting company called Nimbus Hosting got a D rating from BitSight because one of its IP addresses was flagged for hosting malware. It turned out the malware was on a customer's server, not Nimbus's own infrastructure. Nimbus disputed it, but it took weeks to get the rating corrected. By then, they'd lost two prospective clients. Luna: That's the kind of story that gives the industry pause. If the ratings are too noisy, they become a liability instead of a tool. Lucas: Exactly. So the smart buyers I've talked to use ratings as a starting point, not a final verdict. If a vendor comes back with a C or lower, they dig deeper — ask for a third-party penetration test, review logs, have a conversation. The rating triggers inquiry, not automatic rejection. Luna: That seems like the right approach. And it aligns with what we've seen in other areas of security — like using CVSS scores for vulnerabilities. You don't just patch everything above a 9; you contextualize. Lucas: Right. And the platforms are getting better at providing that context. BitSight, for example, now includes 'observation details' — so you can see exactly what drove the score: a specific open port, a specific certificate expiration date. That helps vendors understand what they need to fix and helps buyers assess whether the issue is actually critical. Luna: So we're moving toward more transparency, which is good. But I'm curious — how do these ratings handle vendors that don't have a public-facing infrastructure? Like a software vendor that only sells through a reseller and doesn't have its own external IPs? Lucas: That's a real gap. The ratings rely heavily on external scanning, so if a vendor has no visible attack surface — no public websites, no email servers, no cloud endpoints — the rating might be incomplete. Some platforms address this by incorporating user-reported data, like phishing simulation results or employee cybersecurity training completion rates. But it's not perfect. For those vendors, you still need traditional assessments like questionnaires or on-site audits. Luna: So the ratings are powerful, but they're not a silver bullet. They're one signal in a broader vendor risk management program. Lucas: Exactly. And I think that's the right way to think about them. They're not replacing due diligence — they're augmenting it. And as more data flows in and the algorithms improve, they'll only get more useful. I expect within five years, having a vendor security rating below a C will be a deal-killer for most enterprise contracts, much like having a bad credit score today. Luna: That's a bold prediction. But given the trajectory, I wouldn't bet against it. It just makes sense to have an objective, continuous measure of a vendor's security health. Lucas: And it's already happening. A recent survey by the Cloud Security Alliance found that 72 percent of organizations now use vendor security ratings as part of their procurement process, up from 45 percent just three years ago. That's a rapid adoption curve. Luna: 72 percent. That's the majority of enterprises. So it's not just early adopters anymore — it's mainstream. Lucas: Right. And I think that's a good sign for the industry overall. More data, more transparency, and more accountability for vendors. It's not a perfect system, but it's a huge improvement over the old model of 'trust the PDF and hope for the best.'