Editorial & Advertiser Disclosure Global Banking And Finance Review is an independent publisher which offers News, information, Analysis, Opinion, Press Releases, Reviews, Research reports covering various economies, industries, products, services and companies. The content available on globalbankingandfinance.com is sourced by a mixture of different methods which is not limited to content produced and supplied by various staff writers, journalists, freelancers, individuals, organizations, companies, PR agencies Sponsored Posts etc. The information available on this website is purely for educational and informational purposes only. We cannot guarantee the accuracy or applicability of any of the information provided at globalbankingandfinance.com with respect to your individual or personal circumstances. Please seek professional advice from a qualified professional before making any financial decisions. Globalbankingandfinance.com also links to various third party websites and we cannot guarantee the accuracy or applicability of the information provided by third party websites. Links from various articles on our site to third party websites are a mixture of non-sponsored links and sponsored links. Only a very small fraction of the links which point to external websites are affiliate links. Some of the links which you may click on our website may link to various products and services from our partners who may compensate us if you buy a service or product or fill a form or install an app. This will not incur additional cost to you. A very few articles on our website are sponsored posts or paid advertorials. These are marked as sponsored posts at the bottom of each post. For avoidance of any doubts and to make it easier for you to differentiate sponsored or non-sponsored articles or links, you may consider all articles on our site or all links to external websites as sponsored . Please note that some of the services or products which we talk about carry a high level of risk and may not be suitable for everyone. These may be complex services or products and we request the readers to consider this purely from an educational standpoint. The information provided on this website is general in nature. Global Banking & Finance Review expressly disclaims any liability without any limitation which may arise directly or indirectly from the use of such information.

Companies around the world are striving to get an ‘A’ in cybersecurity

Matthew McKenna, VP EMEA at SecurityScorecard

Credit ratings are a longstanding concept that the majority of people are familiar with, and that most of us frequently concern ourselves with.

A credit check reviews a company’s financials and assigns the score by evaluating whether the company can protect its financial assets and keep from going into debt. Security ratings mirror this concept by reviewing a company’s cyber risk and allocates a score by evaluating to what degree the company can protect its digital assets and keep from being breached. Similar to school reports, security ratings deliver companies and their third-party suppliers with a grade of A-F based on how secure the organisation is and provide them with actionable data on where improvements can be made so they can improve their security and risk posture.

What does a good security score mean?

Security ratings assess an organisation on how well it protects its external facing assets. In a digital world, the importance of data and a company’s protection of that data parallels your income and protection of financial assets. Ultimately, security ratings are indicators of cybersecurity health. A good security rating acts as an organisation’s asset, whilst a poor rating places an organisation at risk, making the data landscape a liability.

Facilitating board level discussion

No one likes to be graded poorly for anything, and board members in top end businesses are no exception. Security is a topic which is commonly neglected by the C-Suite. CISOs work incredibly hard to ensure their company’s cybersecurity is up to scratch, however, they struggle to demonstrate this to the board. No breach proves good work, but this tends to go unnoticed.

However, security ratings can change this. By providing its board members with a report card outlining their security posture, the CISO’s position becomes much more valuable, and his or her work gains attention. A good security rating proves the good work of a CISO.

Not only do security ratings help the CISO of a company gain recognition from the board, they also have a part to play in enabling efficient and clear third-party diligence. Companies seeking to hire vendors need to prove to their boards that they have thoroughly vetted new business partners. Audits and paper-based questionnaires do provide insight but, accessing independently obtained data using a security ratings platform assures the board and auditors of due diligence.

The symbiotic relationship between companies and third parties requires the open conversations that data provides. The more information for both, the better the working relationship.

A complement to other defences

Security ratings are not the only thing a company needs to guarantee total security, so they are not intended to be a catch-all or guarantee for a breach-free future. Instead, they are a measure that helps organisations understand the potential risks that may result from cybersecurity posture weaknesses.

Security ratings can help organisations to remediate vulnerabilities by highlighting weaknesses in their security posture and advising on how they can fix them.

Partners and customers

When speaking with prospective customers, service providers need to be able to provide proof of information security controls and good security performance. A strong security rating can validate that an organisation is practicing good security hygiene and is more likely to work securely with that organisation’s data and IPR. Being able to provide this information generates confidence and loyalty amongst a company’s customer base.

As mentioned, security ratings not only look at a company’s individual security posture, but also that of its vendors. Companies looking to hire vendors require security posture assurance and insight into the risks those vendors pose. To manage third party risk, an organisation can leverage the risk rating to determine the third party’s security profile.

Cyber insurance – is the industry too cautious?

Cyber insurance is designed to financially protect businesses from data breaches and is an important component of enterprise risk mitigation strategy. Underwriters practice caution when issuing cyber insurance policies, because it can be difficult to easily understand the cyberhealth of their clients.

This is where security ratings come in. Accurate security ratings can help carriers, reinsurers, brokers and risk managers better manage risk and continuously monitor policy holders. It’s all about visibility. By being able to accurately evaluate a company’s security posture, insurers can measure how big or small a risk they would be taking if they issued a policy.

A change in the market

Security ratings are an emerging standard; however, they will soon become a norm amongst businesses worldwide, used as commonly as credit ratings. As the cyber threat continues to both spread and become more sophisticated, security is becoming a priority on business agendas. Enterprises are looking for an independent overview of the security posture of those they choose to work with. Security ratings can provide that.