What Is a Cyber Risk Score?

A cyber risk score identifies an organization’s level of exposure to cyber crime and the liabilities that stem from IT vulnerabilities. Think of cyber risk scores as a kind of credit score for cybersecurity. A risk score report provides a valuable way to communicate the strength of an organization’s IT asset management program, both internally and externally.

Organizations use cyber risk scores to evaluate vendors and for internal vulnerability management. In the private sector, cyber risk scoring is becoming a routine part of doing business; Dun & Bradstreet has even added a Cyber Risk Rating product to its business information offerings.

A company’s cyber risk score can affect everything from merger and acquisition opportunities to insurance rates. Monitoring your cyber risk score and seeking ways to improve it have become vital for cybersecurity, and an essential task for chief information security officers (CISOs).

KNOW YOUR IT RISK POSTURE

Cyber risk scores can be expressed numerically, much like a credit score, or can be presented as percentages, with 100 percent representing complete visibility into all cybersecurity vulnerabilities of the organization. The score shows what percent of the risk has been satisfied by controls, such as effective patch management and monitoring tools. What remains is the accepted risk or the level of residual risk that the organization is willing to tolerate.

An organization’s accepted risk will depend on its cybersecurity budget, the ease of mitigating known vulnerabilities and its risk tolerance.

HOW IS A CYBER RISK SCORE CALCULATED?

The first step in creating a cyber risk score is developing a picture of the risk inherent throughout your organization by prioritizing IT assets and assessing the risk factor for each. This assessment should include:

• Cloud data. The cloud is a terrific tool for teams that need to share data, but it can increase the risk of a data breach due to a lack of observability.
• Vulnerabilities assessment. Begin by cataloging potential weak spots in your systems.
• Current and planned controls. What does your organization already have in place for vulnerability management, and what additional controls are necessary?
• Value of assets. You can rate the importance of a data asset based on its role in the organization’s operations, with critical data prioritized in your cybersecurity planning.

• Sensitivity of data. Another measurement of cyber risk is understanding the consequences of a data breach. Records subject to consumer privacy rules or other regulatory frameworks require a higher level of data protection because the cost of a breach, both in fines and in loss of public trust, can be high.

• IT asset discovery. Even before the COVID-19 pandemic, the boundaries between work and personal life had become blurred. Now, with many more people working remotely, the number of endpoints that represent potential cybersecurity vulnerabilities has increased at the same time that the challenge of IT asset discovery has grown. Remote workers often download software that isn’t vetted by IT, presenting an additional risk. In addition, staff with less IT supervision can fail to install software updates, leaving applications with critical vulnerabilities. Persistent asset discovery is vital to software inventory management and patch management.
• Threat review. Assessment of the threat ecosystem involves research into and analysis of the external cybersecurity risks environment.

WHAT ARE THE VARIOUS CYBERSECURITY RISK FRAMEWORKS?

A cybersecurity risk framework is the set of processes and guidelines an organization has developed to mitigate cyber risk.

Cybersecurity risk management programs often adhere to the requirements of one or more cybersecurity frameworks. The most widely applied cybersecurity frameworks include:

• National Institute of Standards and Technology. NIST designed its framework to protect vital government assets, but its standards for cyber risk scoring can be applied to any organization.
• International Organization for Standardization. ISO sets international standards on a variety of topics, including information security management. The ISO/IEC 2700 family of standards provides a framework for vulnerabilities management internationally, which is crucial for businesses that operate in multiple countries.

• General Data Protection Regulation. The GDPR is a set of regulations to protect personal data for EU citizens. Because the rules apply to data collection when EU citizens visit websites, no matter where the website owner is based, many organizations worldwide comply with GDPR standards.
• California Consumer Privacy Act. California’s consumer privacy law is similar to the GDPR in its goal of personal data protection and its data handling requirements. Like the EU regulations, the CCPA’s online data collection provisions have implications for businesses outside California. An update of this law will take effect in 2023.
• Payment Card Industry Data Security Standard. Organizations that want to process credit card payments need to demonstrate compliance with the PCI DSS, an industry-created standard designed to protect consumer information and prevent fraud.
• Health Insurance Portability and Accountability Act. HIPAA sets a U.S. data protection standard for organizations that handle patients’ health-care records.
• Cybersecurity Maturity Model Certification. The CMMC requires that any organization that contracts with the Department of Defense (DoD) meet certain cybersecurity protocols to protect DoD data across the supply chain.

Businesses that handle sensitive consumer information must often follow cybersecurity risk frameworks specific to their industries. Developing a set of internal standards that comply with required cybersecurity risk frameworks is critical to creating a cyber risk management plan.

WHICH DATA SOURCES MATTER TO YOUR IT RISK SCORE?

The short answer is all of them. Unknown assets represent an uncontrolled risk, so IT asset discovery is crucial to risk scoring.

These are the primary data sources that will impact your cyber risk score:

• Cloud data. The cloud is a terrific tool for teams that need to share data, but it can increase the risk of a data breach due to a lack of observability.
• Servers. Protecting the organization’s servers from internal and external threats is a high priority in controlling cyber risk.
• Files on employee devices. Your IT asset inventory needs to include work data stored on laptops, tablets, smartphones and other devices employees use to complete tasks. Every endpoint needs to be inventoried and assessed to develop a complete and accurate IT risk score.
• Third parties. Third-party risks include software as a service (SaaS), data shared with partners, and vendors you allow into your IT ecosystem.

WHAT ARE THE BENEFITS OF SCORING CYBER RISK?

Scoring cyber risk translates a complex data set to a concept that is easy to understand. A risk score is an effective way to communicate the value of your organization’s cyber risk control policies and practices to external and internal stakeholders.

Cyber risk scoring is a must-have rather than a nice-to-have for midsize and enterprise-level organizations in our very online world. To take one example, insurance companies look at cyber risk scores to determine whether an organization is insurable. Organizations with lower cybersecurity risk levels will be able to negotiate lower insurance rates, since hacks and data breaches come with high price tags.

Your organization’s data protection and incident management policies can also have a significant impact on financial transactions. That’s because the cyber risk score is one of the metrics that other entities consider when vetting partners and suppliers. And an unfavorable cybersecurity outlook can be a liability during M&A negotiations.

In addition, cyber risk scores give CISOs a powerful tool for communicating the importance of mitigation programs like performance monitoring and configuration management to other officers. Although recent high-profile ransomware attacks have gotten the attention of the C-suite, communicating the nuances of cybersecurity to busy executives remains a challenge. A cyber risk score gives you a data point that management can quickly grasp and a metric for tracking improved cybersecurity controls.

WHAT IS A CYBER RISK ASSESSMENT?

A cyber risk assessment is an inventory of potential cybersecurity risks, controls to manage risk and the residual unmitigated risk.

The best approach to gathering the data needed to calculate a cyber risk score is multi-pronged. Whether performed by a trusted partner or using internal IT resources, CISOs can start by gathering input from department heads and managers about data-protection requirements and practices. They can also ask staff to inventory the devices and tools they use for work. However, while this input is essential, it can miss information that is vital to calculate the cyber risk score accurately.

Without a thorough IT asset inventory, software inventory management and threat review plan, you won’t be able to put appropriate incident response plans in place. Deploying a tool for automated IT asset discovery gives you more visibility into your network so that you can develop a precise cyber risk score for your organization.

WHAT IS THE DIFFERENCE BETWEEN EXTERNAL AND INTERNAL CYBER RISK?

External cyber risk refers to the threats that arise from outside your enterprise. External risks include distributed denial-of-service (DDoS) attacks, data breaches and ransomware. Even the best vulnerability management strategy includes some residual risk, so it’s vital to have a robust incident response plan in place. For most CISOs today, the question is not whether cyber criminals will target your company but when — and how you will respond.

Internal cyber risks originate from within your organization, a vendor or a partner. These vulnerabilities include both human factors and IT security. Sources of internal cybersecurity risk include:

• Lack of endpoint visibility. Your IT asset inventory includes not only the software on devices that are under the management and control of your IT department, but apps on all endpoints that your employees use for work purposes, including personal devices. A robust and continuous IT asset discovery process is the best strategy to ensure that sensitive data don’t live on unauthorized devices without proper security controls.
• Human error. Common human mistakes include sending an email to the wrong recipient or giving up a password to a phishing scam. Employees should be trained to spot suspicious emails and required to use strong passwords. Training is most effective when you use it in combination with software to filter and block malicious communications.
• Unapproved software. When an employee downloads software that the CISO’s team hasn’t vetted, it can bring malware along with it. And even if the software doesn’t contain malicious code, it can still present a security challenge. Your patch management program can’t fix what it hasn’t inventoried. Software inventory management, especially on remote devices, is crucial to reducing your cyber risk.
• Internal sabotage. It may be hard to imagine a disgruntled employee sharing sensitive data or launching a cyber attack from within, but the risk is real. You can mitigate employee risk with strict security and endpoint management protocols, as well as through a swift and thorough termination and separation process.
• Supply chain attack. The SolarWinds supply chain hack in December 2020 illustrated the ease with which bad actors can use a trusted vendor to gain unauthorized entry into businesses and government agencies. Reviewing the cyber risk score of external partners is now one of the first steps in building a business relationship. Before initiating a partnership that gives an outside entity access to your organization’s sensitive data, it’s crucial to ensure that both parties have strong data protection policies in place to reduce vulnerabilities.

WHAT IS RESIDUAL RISK IN CYBERSECURITY?

Residual risk is the risk that remains after applying controls. To quantify residual risk, start with an accurate assessment of your inherent risk, plus the effectiveness of your risk mitigation measures. What remains is the residual risk. An IT asset discovery program is an essential step in developing a credible residual risk assessment.

HOW CAN RISK SCORING HELP PREVENT RANSOMWARE?

The cyber risk scoring process helps you stay ahead of ransomware attacks by making your organization’s commitment to cybersecurity concrete. Organizations that value a healthy cyber risk score take vulnerability management seriously.


Cyber risk scoring gives you visibility into your system’s strengths and weaknesses so that you can direct your resources wisely. Cyber attacks sometimes succeed because of preventable errors, such as failing to install software updates and poor patch management. Cyber risk scoring can highlight those issues before they lead to a breach. The assessment ranks the value of your IT assets and the threats posed by known vulnerabilities. That gives you an evidence-based foundation for a targeted ransomware prevention strategy.

The best time to deal with ransomware threats is before an attack. Risk scoring gives you a ransomware prevention road map to follow.

HOW DOES RISK-BASED VULNERABILITY SIMPLIFY IT?

Your IT department has many competing goals, and vulnerability management doesn’t often rise to the top of the stack. A risk-based approach gives IT managers concrete tasks to complete, such as software inventory management, patch management and configuration management.

A risk-based approach also provides the IT department with visibility into its role in vulnerability management, plus a metric for measuring improvement. This allows your IT department to take an active part in mitigating cyber risk with well-defined tasks.

HOW DO YOU IMPROVE YOUR CYBER RISK SCORE AND MITIGATE YOUR CYBER RISK?

Once you know your cyber risk score, the next goal is to improve your controls and reduce your level of residual risk. These are some of the steps that can help you boost your score:

Implement continuous performance monitoring. The cyber threat environment and your vulnerabilities can change quickly. Therefore, your cyber risk score can’t simply be a snapshot of a moment in time. With a performance monitoring tool, you can get an accurate and up-to-the-minute report of security issues in any of the thousands of endpoints in your system.

Prioritize configuration management. Misconfiguration of system defaults can cause many types of harm, including making your system more vulnerable to hackers. Include regular security configuration management checkups as part of your cyber risk mitigation plan.

Utilize software and automation tools to mitigate risk. Automation allows you to monitor your risk level continuously. It provides an early warning of potential vulnerabilities, so you’re better prepared to mitigate emerging cyber threats.

Make cybersecurity part of the work culture. In organizations with a solid commitment to mitigating cyber risk, employees enter a work culture where data protection is understood to be part of everyone’s job description. Cybersecurity training should start during onboarding, with frequent refreshers and reminders.

Employ endpoint control. Identify and protect all the devices that employees use for their work.

Develop incident response plans. When you experience a security breach, a speedy incident response can mitigate the loss of business data and reputation.

HOW CAN CYBER RISK BE USED TO JUSTIFY CISO STRATEGY?

Cyber risk scoring gives CISOs an excellent tool to quantify the level of vulnerability of an organization’s IT system. The score gives you an effective way to communicate the level of cyber risk to internal audiences that may not have the technical knowledge to follow the nuances of specific cybersecurity risk factors. The fact that external partners rely on your cyber risk assessment helps make a case for investing the time and money necessary to keep that system safe.

Cyber risk metrics are also helpful in communicating the urgency of cybersecurity through your organization. A cyber risk score can help you enlist department heads and staff in the cause of reducing residual risk by following cybersecurity protocols.

The quality of the data you use to calculate your cyber risk score ultimately determines the value you get from it. Ongoing risk scoring requires effort, but the resources you’ll use to mitigate cyber risk are small compared to the cost of incident response for a major breach.

More resources:

Tool Sprawl Threatens Post-Pandemic Security

Cyber Hygiene 101

A Pandemic Dividend on Cybersecurity & Risk Management for CISOs