Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Companies Use Security Ratings to Vet Third-Party Vendors
Transcript
- Lucas: You're about to onboard a new cloud service provider. The old way — send them a 200-question security questionnaire, wait three weeks, then try to verify their answers. More and more companies are skipping that entirely and just pulling up a security rating score. Luna: Like a FICO score, but for cybersecurity. I've seen BitSight and SecurityScorecard mentioned in vendor contracts now. But how much can you really trust a letter grade based on external data? Lucas: That's the key question. The ratings are based on publicly observable signals — open ports, SSL certificate validity, botnet infections, evidence of past breaches. BitSight, for example, claims to monitor over 125,000 organizations continuously. They're not perfect, but they're a huge step up from the annual self-assessment that's often outdated before it's signed. Luna: Right, because a self-assessment is basically the vendor saying 'trust us.' At least the external scan is independent. But what about companies that don't have much public-facing infrastructure? A SaaS provider might have their servers locked down, but their internal practices could still be weak. Lucas: That's a real limitation. Security ratings lean heavily on external telemetry, so a company with minimal internet footprint might get a high score even if their internal security is sloppy. But the big players are adding more data sources — like breach databases, employee credential leaks, even analyzing the security of their supply chain. So it's evolving. Luna: And the Verizon Data Breach Investigations Report keeps hammering that about one in five breaches involves a third party. So even if the rating isn't perfect, it's a better early warning than nothing. Lucas: Exactly. A typical Fortune 500 company has over 1,300 third-party vendors. You can't send questionnaires to all of them every quarter. With ratings, you can tier your vendors — automatically flag anyone below a threshold, like a C or D, and focus manual effort there. Some banks I've spoken with now have 'auto-reject' policies for any vendor with a rating below 700. Luna: 700 on what scale? BitSight uses 250 to 900, I think. So 700 would be roughly a B-minus? Lucas: Yes, BitSight's range is 250 to 900. SecurityScorecard uses A through F. The specific thresholds vary, but the concept is the same — tiered risk acceptance. And this is being pushed by regulators too. The SEC's cyber risk management rules explicitly require companies to oversee third-party risk. Ratings give boards a digestible metric. Luna: But what about false positives? Say a vendor's IP gets misclassified because of shared hosting or a temporary misconfiguration? Their score drops overnight, and now they're flagged — possibly losing deals through no real fault of their own. Lucas: It happens. I've talked to CISOs who've had to argue with their own risk committee because a key vendor's rating suddenly tanked due to a false positive. The vendors themselves now have 'dispute' processes, and the rating agencies are getting better at ignoring noise. But it's not perfect. You still need human judgment. Luna: So the ratings are a filter, not a final verdict. You use them to triage, then do deeper diligence on the ones that matter. Lucas: Right. And that's the real value — shifting from point-in-time assessments to continuous monitoring. A vendor that looked fine in January might get acquired by a company with poor security in June, and their rating reflects that immediately. Traditional questionnaires would miss that until the next annual review. Luna: I wonder how this affects cyber insurance underwriting. If you can show you're actively monitoring vendors with a rating platform, do you get a premium discount? Lucas: Some carriers are starting to ask for it. AIG and Chubb have pilots where they factor in the insured's average vendor rating. It's early days, but the logic is clear — better oversight means lower risk of a supply chain breach, which means fewer claims. Luna: So we're heading toward a world where security ratings become as standard as credit ratings for business relationships. That's a massive shift. Lucas: It is. And honestly, if these conversations help you think about your own security posture or the vendors you rely on, that's exactly why we do this show. If today's episode was worth a coffee to you, there's a link — buy me a coffee dot com slash fexingo. Luna: Yeah, it's a small way to keep the show ad-free and focused on what matters. And speaking of what matters — back to those ratings. You mentioned that vendors can dispute scores. How often do disputes actually lead to changes? Lucas: BitSight says about 30 percent of disputes result in a score adjustment. That sounds high, but many are legitimate — mistaken attribution of a botnet infection to the wrong company, for example. The process forces both sides to be transparent. Luna: So it's not just about the number; it's about the conversation it starts. That seems like the real win — vendors and customers talking about security more concretely than 'we're SOC 2 compliant.' Lucas: Exactly. SOC 2 is a baseline, but it's a snapshot. Ratings give you a living picture. As supply chains get more complex — think cloud dependencies, SaaS integrations, AI model providers — that continuous visibility becomes critical. I expect we'll see more regulation mandating some form of security rating disclosure, especially for critical infrastructure vendors. Luna: And maybe even a standardized rating system, like credit scores have FICO. Right now, each platform has its own methodology, so a B on SecurityScorecard might not equal a B on BitSight. Lucas: That's a friction point. There's been talk of an industry consortium to create a universal score, but it's hard for competitors to agree. In the meantime, companies are using multiple ratings and averaging them. It's a workaround, but it adds cost. Luna: Still, the trend is undeniable. Three years ago, only a handful of enterprises used security ratings. Now, most RFPs I see include a minimum rating requirement. Lucas: Absolutely. For listeners who manage vendor risk: if you're not using a rating platform yet, start with a free tier. Run your own company's score first to see what your vendors would see. That'll give you immediate context. It's a small step that can change how you think about third-party risk. Luna: Good advice. And maybe the most important takeaway: the rating isn't the destination — it's the start of the conversation. Lucas: Well said. That's it for this episode. Stay secure out there.