Resources
Cybersecurity white papers, data sheets, webinars, videos and more
Resource Library
Ebook
Evolve from Risk Management to Risk Intelligence
Proven Strategies to Drive a Risk Intelligence Program in Your Organization
White Papers
DORA and Cyber Risk: A New Framework for Third-Party Risk in the European Union
DORA is an effort to build resilience within the financial service sector by requiring financial services organizations to establish and monitor networks of trust amongst themselves and their ICT vendors. However, trust requires verification through monitoring and transparency.
Attack Surface Management
Cyber Threat Intelligence
DORA
Research
SecurityScorecard Validation Assessment Summary
Online found SecurityScorecard’s footprinting to be very accurate. Over the course of testing Online evaluated SecurityScorecard’s data for a total of 13 unique, unrelated, and randomly selected domains and found SecurityScorecard’s attribution process to have an accuracy of 95%. The accuracy for positively attributing IP Addresses was found to be 94% while for DNS Records it was found to be 100%.
Blog
Threat Intelligence Research: Volt Typhoon Compromises 30% of Cisco RV320/325 Devices in 37 Days
The SecurityScorecard Threat Research, Intelligence, Knowledge, and Engagement (STRIKE) Team has been investigating covert infrastructure linked to Volt Typhoon, a state-sponsored threat actor group believed to act on behalf of the People’s Republic of China. The group conducts multiple types of cyberattacks, but its use of compromised small office and home office (SOHO) equipment such as routers and firewalls is a recurring theme.
Cyber Threat Intelligence
Press
Canadian Centre for Cyber Security and SecurityScorecard Establish Partnership to Strengthen Cyber Resilience and Secure Critical Infrastructure
Cyber Centre pioneers real-time visibility of national critical infrastructure using nationwide implementation of security ratings, credit scores of the digital world.
Research
North Korean State-Sponsored Cyber Attack: Unveiling the Intricacies of Threat Actor Group Andariel
SecurityScorecard threat intelligence research on state-sponsored cyberattacks
This SecurityScorecard threat research sheds light on a significant cyber attack attributed to North Korean state-sponsored actors known as Andariel, emphasizing the critical role that South Korea plays both as a target and a source of infrastructure for these threat actors.
The STRIKE Team’s comprehensive analysis revealed new details. Please submit the form to download the full report.
Cyber Threat Intelligence
Blog
Vendor Risk Management vs Third Party Risk Management vs Enterprise Risk Management: What’s the Difference?
Third-Party, Vendor, and Enterprise Risk Management are often used interchangeably, but they are not always the same. Learn which is right for your business.
Tech Center
Press
SecurityScorecard and Industry Leaders Deliver Industry-Specific Security Ratings for Telecommunications, Internet Service Providers, and Cloud Providers
SecurityScorecard today announced the industry’s first security ratings developed exclusively for telecommunications, internet service providers, and cloud providers. Through close collaboration with industry leaders, SecurityScorecard sets a new standard for cybersecurity across these critical sectors.
Security Ratings
Blog
7 Incident Response Metrics and How to Use Them
A robust incident response plan provides quantitative data. Check out these seven incident response metrics and how to use them.
Tech Center
Press
業界大手企業と共同で通信事業者、インターネットサービスプロバイダー、クラウドプロバイダー向けの業種別セキュリティレーティングを提供
Learn more in this resource.
Japanese
Blog
SecurityScorecard 10 Risk Factors Explained
Trust begins with transparency. Check out SecurityScorecard’s ten risk factors, which are explained in an easy-to-understand manner that enables business and IT leaders to create meaningful conversations around cybersecurity risk and compliance.
Tech Center
Blog
Introducing Security Ratings for Telecommunications, Internet Service Providers, and Cloud Providers: Collaborating on enhancements with industry leaders
Telecommunications, Internet Service Providers, and Cloud Providers are some of the most critical sectors on the planet. But they are also prime targets for nation-state attacks and other threat actor groups. And their reliance on vast networks of third-party vendors, partners, and service providers creates a need for a comprehensive cybersecurity approach tailored specifically to the sector.
Security Ratings
White Papers
Security Ratings: A New Horizon
Security Ratings Methodology for Telecommunications, Internet Service Providers, and Cloud Providers
Telecom companies, internet service providers, and cloud providers (TICPs) are a pillar of modern connectivity, linking people and companies across the globe. However, these indispensable industries are also prime targets for nationstate actors and motivated cybercrime groups.
A staggering 78% of the top telecom companies in the U.S., U.K., France, and Germany experienced a third-party data breach in the past 12 months alone. These eye-opening findings emphasize the critical need for a transformative approach to cyber risk management. In light of this, SecurityScorecard, in partnership with industry leaders, is pioneering a new approach to advance security ratings for TICPs.
Submit the form to download the full report.
Attack Surface Management
Cyber Threat Intelligence
Enterprise Cyber Risk
Press
SecurityScorecard Reinforces Commitment to Free Security Ratings for All Organizations
SecurityScorecard today unveiled new capabilities to strengthen cybersecurity trust and transparency across the digital ecosystem. Building on a decade-long commitment to providing free security ratings for all organizations, SecurityScorecard innovations advance the industry’s most transparent, trusted, and accurate security ratings.
Security Ratings
Blog
8 Types of Vendor Risks That Are Important to Monitor in 2025
Discover how to manage vendor risk by understanding and monitoring various threats, ensuring your business stays secure from third-party vulnerabilities.
Tech Center
Research
The Increase in Ransomware Attacks on Local Governments
What makes organizations in the public sector vulnerable to ransomware?
Public Sector
STRIKE Team
Research
Third-Party Data Breaches in the Energy Sector
Learn more in this resource.
Research
School District Attack Illustrates Ongoing Threat of Ransomware to Public Education
Interested in reading the report later? Download it. Download Now Executive Summary After a large U.S. school district recently announced that it had suffered a ransomware attack, SecurityScorecard consulted in-house data and strategic partnership sources to enrich the public reporting on the incident. Many of the issues SecurityScorecard’s ratings platform found to affect this district
Public Sector
Research
A detailed analysis of the Menorah malware used by APT34
Executive summary Menorah malware was used by the APT34 group, which targeted organizations in the Middle East and was discovered by Trend Micro in August this year. The malware creates a mutex to ensure that only one copy is running at a single time. It extracts the hostname and the username and computes a hash
Research
Cyber Risk Intelligence Update: Hacktivist Involvement in Israel-Hamas War Reflects Possible Shift in Threat Actor Focus
The SecurityScorecard Threat Research, Intelligence, Knowledge, and Engagement (STRIKE) Team has continued its monitoring of threat actors involved in the war between Israel and Hamas and has integrated this monitoring into its ongoing deep and dark web (DDW) collections. Key takeaways Analysis of these collections appears, as of October 20, to support the following conclusions:
Research
A Deep Dive Into ALPHV/BlackCat Ransomware
Executive summary ALPHV/BlackCat is the first widely known ransomware written in Rust. The malware must run with an access token consisting of a 32-byte value (–access-token parameter), and other parameters can be specified. The ransomware comes with an encrypted configuration that contains a list of services/processes to be stopped, a list of whitelisted directories/files/file extensions,
STRIKE Team