Security ratings4 min read
Vendor security ratings: what the score tells you.
Understand vendor security ratings, review cyber scan findings and track third-party security posture over time.
A security rating is a useful way to organise observable signals. It helps a busy team find a starting point, compare assessments and notice change. Its value comes from understanding the findings behind it and connecting them to the relationship you actually have with a vendor.
Read the scale correctly.
DarkRisk uses a 0 to 100 security score, where higher scores indicate healthier observed security. The rating bands are A for 85 to 100 (very low risk), B for 70 to 84 (low), C for 50 to 69 (medium), D for 30 to 49 (high), and F for scores below 30 (critical). These labels describe the scoring model’s assessment of the observed exposure.
The scoring is deterministic: the same evaluated inputs follow the same scoring rules. That consistency supports repeatable review. It does not turn the rating into a prediction of whether a vendor will have an incident, or a complete assessment of every control inside its organisation.
Look behind the number.
Open the findings that contribute to the rating. DarkRisk’s external scan uses 12 security modules to examine observable exposure. Read each finding’s explanation and evidence, including its affected asset and observation time, before deciding how it relates to your assessment.
Two vendors with a similar overall score can have very different issues. One may need a focused configuration review; another may have several findings that need separate investigation. The detail tells you which questions to ask and gives the vendor a concrete observation to investigate.
Confirm the asset and context.
Check that the scanned domain and associated assets belong to the service under review. Shared infrastructure, redirects and a company’s different products can complicate attribution. If ownership or relevance is unclear, ask the vendor to explain it and retain that explanation with your assessment.
Then consider the business relationship. The same observable issue can have different implications for a vendor handling sensitive information and one hosting public marketing content. Keep the technical observation intact while explaining how access, data and operational dependence influence your team’s decision.
Investigate change over time.
When a score changes, inspect the underlying findings and scan history. Ask whether an issue appeared, an existing observation changed, or a previously affected asset is no longer observable. A new number alone cannot explain what happened.
Scheduled scans create opportunities to revisit the assessment. When a vendor reports a fix, review fresh evidence and a subsequent observation where appropriate. Keep the before-and-after context so a colleague can understand what changed without reconstructing the entire conversation.
Use ratings alongside other evidence.
External observations cannot describe every internal process. Use questionnaires, relevant documents and conversations to assess areas such as access management, incident response and recovery practices. Review the scope and date of supporting evidence rather than treating the presence of a document as sufficient.
A practical assessment brings the score, the findings and the business context together. Explain what you know, what remains uncertain and which action follows. That gives the decision-maker something more useful than a colour or letter on its own.
The short version
Use the rating to prioritise attention. Use the underlying findings, supporting evidence and business context to decide what to do.