A cyber risk score, defined
A cyber risk score (also called a security rating) estimates how likely an organisation is to suffer a cyber incident, based on observable evidence. Lenders summarise repayment history in one number. Cyber risk scores do the same for security posture, so a founder, a customer, a bank or an insurer can compare one business with another without reading a forty-page technical report.
There are two broad approaches. Internal assessments inspect systems from the inside and need access. External (outside-in) scores measure only what anyone on the internet can see. RiskPulse is an external score, which is why it can scan any public domain in about 45 seconds with no installation.
What the CyberScore measures
One scan runs ten checks in parallel and combines them with fixed weights that total 850 points. The weights reflect how often each area contributes to real incidents.
| Check | Points | What it looks at |
|---|---|---|
| Breach exposure | 160 | Credentials for the domain that appear in known breach corpora |
| Known vulnerabilities (CVEs) | 144 | Software versions visible on the internet that match published vulnerabilities |
| SSL/TLS | 119 | Certificate validity, protocol versions and configuration |
| Email authentication | 96 | SPF, DKIM and DMARC policy, which decide whether your domain can be spoofed |
| Open ports | 96 | Services exposed to the internet that should not be, such as databases and remote access |
| Reputation | 64 | Whether the domain is flagged by threat-intelligence sources |
| DPDP readiness | 50 | Public privacy notice, consent controls and grievance contact signals |
| HTTP security headers | 48 | Browser-side protections such as CSP, HSTS and frame controls |
| Dark-web exposure | 48 | Mentions of the domain or mailboxes in monitored sources |
| Cloud exposure | 25 | Publicly reachable cloud storage candidates tied to the domain |
Each finding deducts from its category. The scan also records coverage, meaning how much of the evidence it could actually observe, and confidence. Anything it could not observe is reported as unknown. The full method is on the CyberScore engine page.
CyberScore bands and what to do in each
| Score | Band | What it usually means |
|---|---|---|
| 750–850 | Excellent | Strong hygiene. Maintain it and re-scan after changes. Needs at least 85% coverage. |
| 600–749 | Good | Solid foundations with a few fixable gaps. Work through the top findings. |
| 450–599 | Fair | Material gaps. Fix email authentication, TLS and exposed services first. |
| 300–449 | Poor | Significant exposure. Treat the highest-severity findings as this week’s work. |
| 0–299 | Critical | Urgent. Expect easy wins for attackers. Escalate to an owner immediately. |
What an external score cannot see
An honest score states its blind spots. An outside-in scan cannot observe:
- employee phishing awareness and security training
- endpoint protection, device management and patching of laptops
- internal network segmentation and privileged-access practice
- backup quality and recovery testing
- vendor and supply-chain controls behind the login screen
A high score therefore means the public attack surface is well maintained, not that the whole business is safe. Use it as a fast, repeatable baseline and a conversation starter with your IT provider, not as a guarantee.
How to improve a cyber risk score
- Authenticate your email. Publish SPF, DKIM and DMARC. See the SPF, DKIM and DMARC guide.
- Close exposed services. Databases and remote-admin ports should never be reachable from the public internet.
- Keep software current. Update the web server, CMS and plugins that reveal their versions.
- Harden TLS and headers. Use modern TLS, redirect HTTP to HTTPS and add security headers.
- Reset exposed credentials. If a breach lists your domain, rotate passwords and enable multi-factor authentication.
The website security checklist walks through each item in order.
Cyber risk score questions
What is a cyber risk score?
A cyber risk score is a single number that summarises how exposed an organisation looks to cyber attack. External scores, like the RiskPulse CyberScore, are computed from signals visible from the internet, such as TLS configuration, email authentication, open ports, known-vulnerable software, leaked credentials and domain reputation.
What is a good CyberScore?
On the 0–850 CyberScore scale, 600 to 749 is Good and 750 to 850 is Excellent. 450 to 599 is Fair, 300 to 449 is Poor and below 300 is Critical. Excellent requires at least 85% scan coverage, so a high number with low coverage is shown with a lower label.
Is a cyber risk score the same as a credit score?
It is modelled on the same idea: one comparable number with bands that mean something. The difference is the data. A credit score is built from repayment history, while a cyber risk score is built from observable security posture. It does not measure financial behaviour.
Can an external scan see everything about my security?
No. It sees what the internet sees. It cannot see employee training, internal network segmentation, endpoint protection, backups or access reviews. That is why RiskPulse reports coverage and confidence next to the score, and marks unobserved areas as unknown instead of treating them as clean.
How often should I check my score?
After every meaningful change to your website, email setup, hosting or DNS, and at least monthly otherwise. Exposure changes when certificates expire, new software versions publish vulnerabilities or credentials appear in new breaches.