Cybersecurity white papers, data sheets, webinars, videos and more

Press

SecurityScorecard Reaffirms FedRAMP and Achieves StateRAMP Ready Status

U.S. federal, state and local agencies to adopt SecurityScorecard SCDR to secure supply chains with confidence

Blog

A Deep Peek at DeepSeek

DeepSeek’s rapid ascent in the AI space has made it impossible to ignore. Its sophisticated models and AI assistant have captured global attention. And, while headlines focus on DeepSeek’s capabilities, STRIKE research exposes critical security flaws, hidden data flows, and unanswered questions about who has access to the data and why.

STRIKE Team

Research

Insurance Carriers Face Unprecedented Supply Chain Cyber Threats

SecurityScorecard’s analysis of 150 leading insurance companies exposes a critical weakness: even carriers with robust security are being compromised through their supply chain partners. Our data reveals that threat actors are deliberately exploiting lower-scoring vendors to breach otherwise well-defended insurance organizations. Key Findings: Third-party breach rate hits record 59% in insurance – more than double the global average, with ransomware dominating the attack landscape Insurance carriers outperform vendors in security scores but face heightened risk through weaker supply chain partners Cross-industry software vulnerabilities caused 37% of breaches – nearly triple the rate of insurance-specific software issues U.S. carriers face disproportionate targeting despite strong security postures, with 79% of multi-breach victims being U.S.-based   Download the Report and get the detailed analysis and practical recommendations for strengthening your supply chain security

Press

SecurityScorecard Report: 59% of Breaches Impacting Insurance Sector Caused by Third-Party Attack Vectors

Report highlights need to address third-party risks as cybersecurity gaps threaten critical services and policyholder trust.

メディア掲載

ScanNetSecurity: 「SecurityScorecard」が自らを ASM と名乗らない理由

Learn more in this resource.

Japanese

Resources

Max Data Processing Agreement

Learn more in this resource.

Blog

Third-Party Risk Management Framework: How to Select the Right One

Third parties come with significant cyber security risks. Learn how to select the right risk management framework.

Blog

Beyond the Perimeter: Why CISOs Need Threat-Informed TPRM

Organizations rely heavily on external vendors and suppliers, creating complex supply chains vital for operations. However, this introduces a new dimension of risk: supply chain attacks move fast. While standard TPRM focuses on compliance, Threat-Informed TPRM is a proactive, data-first defense engine designed to stop attacks before they reach your network. The Growing Threat of

Supply Chain Cyber Risk

Threat-Informed TPRM

Case Studies

Verdane

How Verdane improved investment decisions and portfolio company cyber support using SecurityScorecard.

Webinars

The CEO’s Take: Bridging the Cybersecurity Divide To Address Cyber Risk

Learn more in this resource.

Data Sheet

Simplify and Automate NIS2 TPRM Requirements with SecurityScorecard

The Network and Information Systems Directive (NIS 2) is a comprehensive set of regulations adopted by the European Union (EU) to enhance the cybersecurity resilience of critical sectors in the face of increasing ICT risks. The regulation focuses on: Risk management: NIS 2 mandates organizations to implement comprehensive cybersecurity risk management frameworks, including identifying and assessing ICT risks, implementing controls to mitigate these risks, and regularly testing the effectiveness of these controls. ICT cybersecurity incident management: NIS 2 requires organizations to establish robust processes for ICT cybersecurity incident management, including incident detection, response, and reporting. Organizations need to define roles and responsibilities, establish communication protocols, and Testing: NIS 2 requires organizations to establish robust processes for ICT cybersecurity incident management, including incident detection, response, and reporting. Organizations need to define roles and responsibilities, establish communication protocols, and Third-Party Risk Management (TPRM): NIS 2 requires organizations to establish robust processes for ICT cybersecurity incident management, including incident detection, response, and reporting. Organizations need to define roles and responsibilities, establish communication protocols, and In this extended data sheet, we’ll outline these key components of NIS 2 in more depth and guide you through how you can use SecurityScorecard to enable compliance and operational resilience.

Data Sheet

Simplify and Automate DORA TPRM Requirements with SecurityScorecard

The Digital Operational Resilience Act (DORA) is a comprehensive set of regulations adopted by the European Union (EU) to enhance the operational resilience of the financial sector in the face of increasing ICT risks. The regulation focuses on: Risk management: It mandates organizations to implement comprehensive risk management frameworks, including identifying and assessing ICT risks, implementing controls to mitigate these risks, and regularly testing the effectiveness of these controls. ICT incident management: DORA requires financial entities to establish robust processes for ICT incident management, encompassing incident detection, response, and reporting. Organizations need to define roles and responsibilities, establish communication protocols, and conduct regular testing to ensure their incident response capabilities are adequate. Testing: The act emphasizes the importance of regular testing, including penetration testing, vulnerability assessments, and business continuity and disaster recovery exercises, to verify the resilience of systems and processes. Third-Party Risk Management (TPRM): DORA places significant emphasis on managing third-party ICT service providers. Organizations must conduct thorough risk assessments, incorporate DORA TPRM requirements into contracts, and continuously monitor the security posture of their third parties. In this extended data sheet, we’ll outline these key components of DORA in more depth and guide you through how you can use SecurityScorecard to enable compliance and operational resilience.

Research

Operation Phantom Circuit: North Korea’s Global Data Exfiltration Campaign

During STRIKE’s investigation of Operation 99, our team identified multiple command-and-control (C2)\r\nservers active since September 2024.

STRIKE Team

Blog

Operation Phantom Circuit: North Korea’s Global Data Exfiltration Campaign

In December 2024, a routine software update concealed a global threat. Attackers from the Lazarus Group, based in North Korea, infiltrated trusted development tools, compromising hundreds of victims worldwide. This sophisticated campaign, code-named “Phantom Circuit,” targeted cryptocurrency and technology developers, employing advanced obfuscation techniques through proxy servers in Hasan, Russia.

STRIKE Team

Webinars

Building a High-Performing Supply Chain Incident Response Team

Supply chain security is no longer an afterthought. With increasing threats and the potential for devastating consequences, organizations must proactively address supply chain risks. In this webinar, we will discuss how a well-structured supply chain incident response team can address these challenges and mitigate risks.

Threat-Informed TPRM

メディア掲載

MONOist: 製造業のサプライチェーンセキュリティ対策に欠かせない「TPRM」とは？

Learn more in this resource.

Japanese

事例

日東工業株式会社 様

株式会社ネットワークバリューコンポネンツによる導入事例

Japanese

Webinars

The CISO’s Take: Securing the Future of Financial Services & More

Learn more in this resource.

Press

SecurityScorecard Report: 58% of Breaches Impacting Leading U.S. Federal Contractors Caused by Third-Party Attack Vectors

Report highlights the urgent need for federal contractors to address third-party risks as cybersecurity gaps threaten national security

Blog

5 Reasons to Integrate Continuous Monitoring into Your TPRM Program

Learn 5 reasons your organization should integrate continuous monitoring into their third-party risk management program. Read SecurityScorecard’s blog

Research

Security Assessment of the Top 100 U.S. Gov’t Contractors

Federal contractors are integral to supporting the operations of the U.S. government. However, as these contractors face evolving cyber threats, it’s critical to understand the vulnerabilities that could affect their ability to secure sensitive data and provide essential services. This report examines the security ratings and breach histories of the top 100 U.S. government contractors, uncovering significant gaps that could disrupt government functions and expose sensitive information. Key Findings: 58% of breaches were caused by third-party vulnerabilities, posing a direct threat to both contractors and the government. 35% of contractors had at least one publicly reported breach, with some experiencing multiple incidents, indicating a recurring security problem. Ransomware groups were responsible for 41.25% of breaches, and the frequency of attacks on third-party vendors (46.5%) is rising. 28% of contractors had malware infections or compromised devices, showing a need for stronger internal security measures. Defense and intelligence contractors had the highest security ratings, but technology and telecommunications contractors were among the lowest.   Download this report to learn more about the current landscape and discover practical steps that can be taken to enhance the security of the federal supply chain.