A cyber risk score is a quantitative measure that assesses the cybersecurity posture of an organisation on a defined scale — based on externally measurable security indicators.
How is a cyber risk score calculated?
A cyber risk score typically aggregates: external attack surface (open ports, exposed services), known vulnerabilities (CVEs) and their severity, dark web leaks and credential exposure, DNS and email security configuration (SPF, DKIM, DMARC), SSL/TLS certificate status, data breach history, patch management speed, and software versions and end-of-life status. 360TPRM calculates a current cyber risk score daily for every supplier.
360TPRM calculates a cyber risk score for every supplier every day — no questionnaires, based exclusively on external data sources.
The cyber risk score as a TPRM instrument
In a TPRM context, the cyber risk score enables: objective comparability across all suppliers, risk-based prioritisation of monitoring effort, trend analysis over time (is a supplier improving or deteriorating?), early detection of risk escalations, and regulatory-compliant documentation for NIS2 and DORA.
Questionnaires measure what suppliers say about themselves. Cyber risk scores measure what's actually measurable externally. The difference can be substantial.
FAQ
Automate cyber risk score calculation
See in a 45-minute demo how 360TPRM specifically meets your requirements.
Request free demo →