The trouble with asking a supplier whether it is secure is the tense of the question. A questionnaire records an answer at a particular moment. The internet keeps moving. A server appears. A patch slips. Someone’s credentials turn up for sale. Yesterday’s reassuring document may still be sitting in the procurement folder.
- Bitsight turns external security observations into daily ratings.
- Its buyers use the evidence to assess suppliers, their own systems and insurance risk.
- The business now connects those observations with threat intelligence and remediation workflows.
The questionnaire had a timing problem
Consider the outdoor retailer Cabela’s. In a historical Bitsight case study, its vendor management team described field assessments and questionnaires as expensive, time-consuming and poor at catching sudden changes in security performance. Continuous ratings gave the team another way to assess vendors, compare its own performance with retailers and bring suppliers into security conversations. The weakness was the interval between inspections.
That interval became a business opportunity. Stephen Boyer and Nagarjuna Venna founded Bitsight in 2011. Boyer had worked on cybersecurity research at MIT Lincoln Laboratory and co-founded Saperix, a vulnerability and network risk company. Bitsight’s proposition was to inspect observable evidence from outside an organization, then make that evidence useful to people deciding whether to trust it.
A number with a detective behind it
The familiar product is a daily security rating on a 250-900 scale. Higher is better. Underneath sit observations about compromised systems, security hygiene, user behavior and disclosed incidents. The useful trick is comparability: a risk manager can put many companies into the same frame without first installing software throughout their networks.
But the detective work comes before the arithmetic. Which domains and IP addresses belong to which organization? Does an exposed service belong to the supplier, a subsidiary or somebody else? Attribution determines whose problem the observation becomes. Bitsight combines asset mapping, scanning, data analysis and research to construct that outside view.
A comparison tool. A starting point for investigation.
This is also why a rating needs a correction mechanism. Bitsight’s published governance process lets rated organizations challenge assets, findings and their interpretation, including organizations that are not customers. An outside observer can produce useful evidence. It also needs to hear when it has assigned the wrong evidence to the wrong company.
SecurityScorecard and Mastercard’s RiskRecon compete for similar external risk decisions. Bitsight’s case increasingly rests on the combination around its rating: supplier workflows, exposure discovery, financial risk analysis and threat intelligence. Buyers should compare the findings and workflow against their own vendor portfolio. A familiar number alone cannot settle that purchase.
The $115 million second question
In September 2021, Moody’s announced a $250 million investment at a $2.4 billion valuation. Bitsight also acquired VisibleRisk, the Moody’s and Team8 venture focused on cyber risk quantification. The connection was practical: boards and financial institutions needed to translate technical exposure into potential financial loss.
Then came a different question. Knowing a system is exposed does not tell you who might be preparing to exploit it. In November 2024, Bitsight announced its $115 million Cybersixgill acquisition; it closed that December. Cybersixgill brought collection from underground forums, markets, messaging groups and other sources. Bitsight could connect the map of exposed assets with intelligence about criminal activity.
“No organization is impenetrable”
Steve Harvey, then CEO, on the acquisition’s closing
The subsequent products show that direction. Identity Intelligence addresses compromised credentials. Vendor Risk Management organizes assessments and follow-up. Trust Management Hub exchanges security evidence. Security Posture Management, introduced in March 2026, combines external exposure, threat context, governance and benchmarking. The portfolio follows the questions that come after a score lands on someone’s desk.
Company-reported milestones. ARR measures recurring contracts, rather than annual recognized revenue.
Bitsight reported passing $200 million in annual recurring revenue in April 2025, alongside positive free cash flow. Its announcement said 70% of new deals in 2024 included exposure management. That mix suggests customers were buying a wider view of risk. By 2026, Bitsight reported more than 3,500 customers, spanning enterprise security teams, insurers, financial institutions and public agencies.
Those customers have different jobs for the same evidence. A supplier manager wants to know where to investigate before onboarding. An insurer wants information for underwriting and portfolio monitoring. A security leader wants to compare subsidiaries or explain priorities to a board. Bitsight sits between technical observations and those commercial decisions, selling access to the data and the tools that make it usable.
The factory is on the internet, too
The Schneider Electric partnership makes the idea tangible. Announced in January 2023, it combined Schneider’s knowledge of industrial systems with Bitsight’s exposure detection. The aim was to identify internet-facing operational technology and improve attribution, helping Schneider notify customers about exposed or insecure deployments.
In a later account, Bitsight described Schneider funding research and development for those capabilities. Building safer equipment and explaining how to deploy it had not eliminated insecure installations. Continuous exposure data gave the manufacturer a way to reach customers about specific systems. Here, the valuable output was a conversation with someone who could change the deployment.
Give the finding an owner
The same principle applies to an ordinary supplier program. Start with business-critical vendors. Check that the mapped assets belong to them. Examine findings alongside internal evidence and assessments. Assign an owner and a deadline, then verify remediation. This is a workflow a reader can copy; purchasing a dashboard does not supply the organizational authority to execute it.
Bitsight’s packages reflect that operational scope. Prices require a quote, with vendor coverage, capabilities, integrations and services affecting cost. Threat intelligence packages also scale by licenses. Subscription software is the core model, supplemented by data delivery and professional services. An external rating cannot reveal every internal control or promise that an organization will avoid a breach.
John Clancy became CEO in April 2026. In September, Bitsight announced Beacon’s general availability, connecting supply chain exposure and threat monitoring, alongside MCP and agentic access. The intended destination is shared evidence for security operations and vendor risk teams. The question for a buyer is wonderfully concrete: when something changes outside the company, who inside will do something about it?