Security rating

A security rating is an assessment of a company's cybersecurity based solely on what is visible from the outside: its domains, publicly reachable systems, configurations and known incidents. The result is a grade or score that can be compared over time. It is used mainly for suppliers and service providers, companies whose systems the customer cannot look into.

Why security ratings matter

In Verizon's 2026 Data Breach Investigations Report, a third party was involved in 48 per cent of the breaches analysed, for example a supplier, a hosting provider or an outsourced IT provider. Traditionally this risk is captured with questionnaires and audits. Both are snapshots and rely largely on self-reporting.

A security rating adds a regular, independent outside view. It shows whether a supplier runs outdated software with known vulnerabilities, whether its email domain is protected against spoofing and whether it has appeared on a ransomware leak site. When the grade drops, that is a concrete reason to ask questions before the weakness turns into an incident.

How a security rating works

The rating provider examines a company's internet-facing infrastructure from the outside, without access to its systems and without its involvement. Findings are assigned to rating areas, weighted and condensed into a score, usually with a grade as well. Each provider decides which areas count and how they are weighted, so grades from different providers are not directly comparable. blacklens.io rates nine areas:

• Software patching: outdated and end-of-life software, known vulnerabilities
• Application security: security headers, cookies, admin logins, trackers
• Web encryption: certificates, TLS protocols and ciphers
• Breach events: leaked credentials, ransomware leak-site listings
• Network filtering: exposed services, remote access, IoT devices
• System reputation: blocklisted addresses and hostnames
• Email security: SPF, DKIM, DMARC, MTA-STS, STARTTLS
• DNS security: DNSSEC, zone transfers, CAA, name servers
• System hosting: hosting providers, geography, domain registration

How blacklens.io uses security ratings

In the Supply Chain Monitoring module, blacklens.io rates every supplier from the outside; the supplier has nothing to install or approve. One supplier is one registrable domain. The first rating starts automatically after the supplier is added, and every supplier is re-rated every 7 days. The result is a grade from A to F with a score from 0 to 100. Areas that cannot be measured are left out instead of counting as 0. While a severe finding stands, such as a known-exploited vulnerability or a ransomware leak-site listing, the grade is capped and the detail view names the reason. Every finding comes with a description and remediation guidance ("What was found", "How to fix it").

When a new rating is worse than the previous one, because the grade drops or a known-exploited vulnerability, a critical finding or a ransomware listing appears, the alert "Supplier risk increased" reports it by email, push or integration. Reports are available per supplier (Supplier Report, on demand) and for the whole portfolio (Supply Chain Report, one-off or scheduled). The ransomware watchlist complements the rating: it matches leak sites against your suppliers' domains about every 30 minutes and reports a supplier after an attack. The rating shows the risk beforehand.

What can a security rating not do?

A security rating only sees what is visible from the outside. It says nothing about a supplier's internal controls, permissions, backups, emergency plans or training. A good grade therefore does not mean a supplier is secure, only that it shows no obvious weaknesses from the outside. Attribution has limits too: the rating covers what can be attributed to the supplier's domain, so systems under other domains or at further service providers may be missing.

Does a security rating replace the supplier questionnaire?

No. A questionnaire records what a supplier states about itself: processes, certifications, internal controls. A security rating measures what is actually visible from the outside, at short intervals rather than once a year. The combination works best: the rating shows which suppliers to question more closely, and the questionnaire or audit clarifies what things look like internally.

Do NIS2 and DORA require a security rating?

No, neither regulation prescribes a specific tool. NIS2 requires supply chain security measures in Article 21(2)(d) and, under Article 21(3), that entities take into account the vulnerabilities specific to each direct supplier and the quality of its cybersecurity practices. DORA governs financial entities' ICT third-party risk in Articles 28 to 30. A security rating can provide dated evidence for this, but it does not replace contractual and organisational measures.