Now Available - Forrester Report: The Total Economic Impact™ Of The CyCognito Platform
Solutions
Skip to main content
Item 1 of Infinity
Skimming The Attack Surface With Traditional Cyber Security Assessments Increases Cyber Security Risks
Learn why security rating services are so unpopular.
If you’re analyzing the IT risk associated with a supplier, then a security rating service may be what you need. However, even for management of third-party risk, security professionals are generally not enthusiastic about security ratings services that offer simple scorecard-like functionality.
Many chief information security officers (CISOs) are dissatisfied with the over-simplified scorecard approach and the fact that the scoring is not based on in-depth security analysis.
In fact, a leading global advisory firm released a 2020 report on these ratings services that shows that only 18% of security leaders in the U.S. find security ratings valuable for third-party management. The highest rating was from India, where a mere 25% find these rating services add value.
If your goal goes beyond a security rating for a vendor for procurement purposes — managing your attack surface or evaluating the security posture of your own organization, your subsidiaries, or a merger and acquisition (M&A) target — using a cybersecurity rating dashboard solution is an even riskier choice.
Only 18% of U.S. security leaders find security ratings valuable for third-party risk management.
Cybersecurity Risk Ratings Market Outlook
Forrester Research, Inc. March 2020
Identify the Path of Least Resistance
Assessing and managing your security posture requires an approach that security rating services simply don’t take, which is discovering the attack surface in depth and detecting the POLaR - Path of Least Resistance™. That’s what attackers do when they are out to compromise your organization: they find the easiest way to reach and exploit high-value targets.
The CyCognito Platform Applies the POLaR Principle to:
Security Ratings Services Drawbacks
Security ratings service vendors promote their products for attack surface management or organizational security assessments, but they were not designed for deep inspection or remediation of security issues.
Instead, those cybersecurity ratings solutions were designed to deliver a high-level scorecard-style rating for procurement purposes, not to provide in-depth security risk analysis with scores applied to each asset and each attack vector in the organization being assessed. In fact, the purpose of security ratings solutions is merely to produce a score, rather than the score being the result of a thorough security posture assessment. This is a key reason that a ratings service is the wrong tool to use when security expertise is critical to the process and final result.