Understanding Vendor Scores and Methodologies

RiskRecon is a Mastercard company that provides automated cybersecurity risk ratings that assess the real-world performance of third-party systems. It evaluates both the prevalence and severity of security issues and the value at risk in affected systems.

Rating Scale

Numeric score from 0.0 to 10.0, with 10 being the best, overlaid with an A–F grade.

Scoring Insight

Ratings reflect how well an organization manages its cybersecurity risks, factoring in the criticality of systems and issue severity.

Methodology

Uses passive, non-invasive techniques to analyze internet-facing systems across nine security domains and ~40 criteria.

Risk Prioritization

Issues are weighted based on the sensitivity of the system they affect, ensuring that high-value systems with vulnerabilities are scored more critically.

RiskRecon’s model supports informed decision-making by highlighting the most impactful risks in your third-party ecosystem. For more information, please refer to the RiskRecon Rating Methodology whitepaper.

SecurityScorecard is a cybersecurity rating service that provides objective, continuous monitoring of an organization’s external security posture. It uses a proprietary scoring methodology that evaluates organizations across 10 risk factor categories, including DNS health, endpoint security, IP reputation, and patching cadence.

Rating Scale

A–F letter grades, mapped to a numeric score from 100 to 0.

Scoring Insight

Organizations with an A rating (90–100) are 13.8 times less likely to suffer a breach than those with an F (≤60).

Methodology

Scores are calculated using an outside-in, non-intrusive approach, analyzing internet facing assets and assigning severity-weighted scores to discovered issues.

This scoring system enables organizations to benchmark third-party security hygiene and prioritize vendors for deeper assessments based on breach likelihood. For more information, please refer to the SecurityScorecard Risk Scoring Methodology whitepaper.

HackNotice is a real-time threat intelligence platform that delivers immediate alerts on data breaches, ransomware activity, and leaked credentials associated with your third parties. It combines AI-powered automation with human analysis to monitor thousands of sources, including hacker forums, Telegram channels, and breach disclosure databases.

Notification Focus

Verifiable data breaches, ransomware attacks, and credential leaks.

Alert Delivery

Instant alerts are triggered the moment a threat is detected—no delay, no manual filtering.

Data Sources

Includes dark web forums, encrypted messaging platforms, and public breach disclosures.

HackNotice’s breach feed and ransomware alerting are integrated into the Third-Party Risk Exchange, enabling proactive risk mitigation and faster incident response.