Security ratings are quantified, continuously updated measures of an organisation's cybersecurity posture, produced from data observable without that organisation's cooperation. A single security rating is the credit-score analogy of security: an outside party forms a view from evidence it can gather independently, and that view updates as the evidence changes.
They are also called cyber security ratings, cybersecurity ratings or security scores — the same measurement under different labels, and the wording varies more by vendor than by method.
RiskXchange scores on a 0–900 scale, presented as an A–F grade. The number is what moves and what you track over time; the letter is the summary a board or a vendor conversation actually uses. They are the same measurement, not two ratings.
The signals behind it are the ones an attacker would also see: externally exposed infrastructure — domains, subdomains, IP ranges, open services and their versions — TLS and certificate configuration, email authentication such as SPF, DKIM and DMARC, DNS hygiene, patching latency on internet-facing software, exposed or misconfigured services, leaked credentials appearing in breach corpora, and reputational signals like appearance in botnet or malware telemetry.
What a rating cannot see is the inside: encryption at rest, network segmentation, privileged access management, staff training, backup and recovery testing. That is the honest limit of the method, and it is why RiskXchange combines the outside-in score with the vendor's own evidence — questionnaires, certifications, policies — rather than treating the rating as the whole answer. The gap between what a vendor claims and what is externally observable is frequently the most useful finding. For how the major platforms compare, see our platform comparison.
Most security ratings are single-signal — outside-in scans only — and most of them sit between refreshes for weeks at a time. A score that moves the day after the breach is a score that didn't help.
The rating is the head of the funnel. REX produces the score from continuous external scanning. ARIA layers in the vendor's own evidence. TARA decides what a drop should actually trigger.
A rating that's continuously, not occasionally, calibrated. REX's Outside-In Scanner refreshes daily for customers and weekly for vendors — and the Continuous Monitoring sub-agent watches the time-series for material changes around the clock.
A rating, joined to the vendor's own evidence. ARIA pairs REX's external score with the vendor's questionnaires, certs and trust centre — so the rating reflects both what we can see and what's been attested.
A drop that triggers the right action automatically. When a rating moves materially, TARA decides what it means — for that vendor's tier, against the regulatory frameworks in scope, and what the SLA-bound remediation should be.
The number stops being a thing you check on a dashboard and starts being something the agents act on while you sleep.
Continuous Monitoring catches material rating changes in real time, not at the next refresh window.
Click any rating and you get the underlying signals — scan data, breach findings, attested evidence — joined together.
When a vendor scores well externally but the questionnaire suggests otherwise, ARIA flags it before you investigate.
A material rating change opens a TARA-led remediation track without waiting for someone to spot it on a dashboard.
The combined-signal model is the difference. We stopped arguing about whose rating was 'right' — we started looking at the score and the evidence together.
How the score is built, what it can and cannot tell you, and what to do when a vendor disputes theirs.
Book a 30-minute call and we'll have NOVA, ARIA and REX produce a complete posture report on one of your live vendors inside 24 hours.