SecurityScorecard: The grade is just the beginning

One person was supposed to keep an eye on 600 vendors. The organization, a shared-services provider supporting nearly 70 food manufacturers, already had a sensible system: assess critical suppliers carefully, then monitor everyone. But according to a SecurityScorecard case study, one employee’s capacity could cover only 20% of the vendor population. The policy was comprehensive. The working day was not.

After adopting MAX, SecurityScorecard’s managed service, the provider reported coverage of all its vendors. This is an anonymous customer’s result, published by the seller, rather than an independent experiment. Still, the bottleneck is instructive. Buying more information would not have created another employee. Someone had to do the work that followed the warning.

SecurityScorecard began by making that warning easier to read. It gathers signals about internet-facing systems and turns external security posture into letter grades. A procurement team can compare suppliers. A security team can investigate the findings behind a score. An insurer can add another input to underwriting. A board can discuss exposure without first learning the grammar of a vulnerability scanner.

The paperwork looked excellent

The founding story contains an uncomfortable reversal. While working at online retailer Gilt Groupe, Aleksandr Yampolskiy considered a fraud-prevention provider. In his later account, the supplier produced reassuring security documentation. During integration, his team discovered other customers’ unencrypted credit-card data. The service intended to reduce one risk was introducing another.

Yampolskiy and fellow Gilt alumnus Sam Kassoumeh founded SecurityScorecard in 2013. Their experience combined security operations with technical depth: Yampolskiy holds a Yale doctorate in cryptography; Kassoumeh had led security and compliance at Gilt and worked in information security at Federal-Mogul. The problem they pursued was concrete. How do you judge the security of a company whose systems you do not operate?

Their early sales assumptions did not survive contact with a finished prototype. Yampolskiy recalled that prospects who had expressed interest stopped responding when the product was ready in 2014. The founders had to seek new buyers. That is a useful distinction for anyone building enterprise software: an encouraging conversation carries no purchase order.

A grade needs a next step

Ratings remain central. SecurityScorecard’s methodology groups observations into ten risk factors, helping users move from a summary grade to particular issues. The appeal is a common vocabulary across organizations. Its public culture guide makes the ambition unusually explicit: make “What’s your Scorecard?” a familiar question in business and government.

But a shared vocabulary still needs an operating process. SecurityScorecard acquired digital-forensics and incident-response firm LIFARS in February 2022. MAX followed in January 2024, putting monitoring, vendor outreach and remediation support into a managed service. The company said the acquisition supplied expertise for that offering. This was a consequential expansion for a business known for measuring other companies.

An encouraging conversation carries no purchase order.

In March 2026, it introduced TITAN AI. The launch organized the platform around three jobs: Watch for continuing visibility, Assess for questionnaires and prioritization, and Secure for threat-informed remediation. MAX adds people to those workflows. Think of the difference between receiving a list of troublesome suppliers and having a team pursue responses from them.

The intelligence behind that process is expanding too. In May 2026, SecurityScorecard acquired internet-scanning company Driftnet, bringing its discovery engine into TITAN AI. The practical aim is fresher information about exposed systems. For buyers, the test is whether that information improves a decision or accelerates a fix in their own supplier population.

Who pays for the follow-through?

The commercial model combines enterprise software subscriptions and managed services, sold directly and through partners. A free account lets an organization inspect its own scorecard. Broader monitoring and operational support require a sales conversation; the public pricing page lists capabilities rather than dollar amounts. A buyer should ask for the monitored-vendor scope, assessment workload and escalation responsibilities in the same quote.

There is substantial capital behind this approach. A $180 million Series E in March 2021 brought disclosed funding above $290 million. Participants included Silver Lake Waterman, funds advised by T. Rowe Price Associates, and existing investors. Those are financing figures. They say nothing about what a particular customer will pay or save.

SecurityScorecard’s current company page reports more than 3,300 organizations relying on it and says 70% of the Fortune 100 trust its data. Separately, it reports monitoring and rating over 12 million organizations. That last number describes coverage. Public customer examples include Aflac and McDonald’s; security teams, insurers and government agencies have different reasons for wanting the same external view.

Bitsight competes directly in ratings. Black Kite and Panorays overlap in third-party cyber risk. SecurityScorecard’s broader pitch combines ratings, assessment workflows, threat intelligence and managed follow-through. Partnerships extend delivery: Uniqus announced a MAX alliance in 2025, while a March 2026 Dataminr agreement proposed combining exposure information with tailored threat intelligence. Buyers should compare the work delivered, alongside the dashboards.

Copy the workflow, not the score

The food-manufacturing example offers a practical habit: tier suppliers by business importance, then give findings an owner and a route to resolution. External observations need context. A vendor with sensitive access deserves different scrutiny from one whose outage would be inconvenient. A rating cannot establish every internal control, and an incorrectly attributed asset can send a team chasing the wrong company.

Nor can software make an unwilling supplier patch a system. Someone must validate evidence, negotiate priorities and check completion. SecurityScorecard’s evolution makes that often invisible labor the product. The most revealing question to ask after seeing a security grade is wonderfully ordinary: whose job is the next step?