SecurityScorecard

SecurityScorecard AI-powered, threat-informed third-party risk management. Continuous visibility and predictive intelligence to secure global supply chains.

SecurityScorecard leads the way in Supply Chain Detection and Response, empowering organizations to swiftly manage and mitigate critical third-party risks.

10/23/2026

📊 Reviewing a vendor questionnaire answer by answer takes hours your team doesn’t have.

In this installment of SecurityScorecard’s TITAN demo series, see how TITAN AI scores and analyzes assessments automatically.

You set the criteria once at the template level. Our platform handles the review when the supplier submits.

✅ Set pass and fail weighting for each risk metric

🤖 Check answers against your policy and the supplier’s uploaded evidence

📥 Pull answers from documents already in the vendor’s profile

In the demo, one assessment returns 36 passed answers, 2 failed, 4 partial, and 4 empty. You can drill into each section to see why.

📺 Watch the demo below

👉 See how to get a questionnaire health score and risk score without reviewing every response by hand: https://securityscorecard.com/resources/video/scoring-and-analyzing-assessments-in-titan-ai/?utm_campaign=&utm_content=&utm_medium=social&utm_source=facebook

10/23/2026

🚨 SecurityScorecard’s STRIKE Threat Intelligence Team found more than 7.6 million internet-facing assets running PHP.

Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) are facing attack attempts. One unpatched shared dependency can take down many services at once.

Here’s what to do today:

🔗 Map the hosting providers and managed service providers (MSPs) behind your most critical services

🛡️ Confirm your WAF rule sits in the request path, because a reachable origin skips it

🔐 Rotate secrets if you see probing, since one flaw can leak process memory

📺 Watch TITAN Secure with the Driftnet add-on build a PHP2Shell response workflow, from vendor exposure to a verified fix.

👉 Read the advisory and learn how to rank your public services by mission impact and shared dependencies: https://securityscorecard.com/blog/shared-dependencies-turn-php-flaws-into-a-public-service-risk/?utm_campaign=&utm_content=&utm_medium=social&utm_source=facebook

The EU AI Act moved from preparation to enforcement on August 2, 2026. For most security teams, that raises a harder que...
10/23/2026

The EU AI Act moved from preparation to enforcement on August 2, 2026. For most security teams, that raises a harder question than “are we compliant?”

Do you actually know where AI exists across your supply chain?

AI often enters an organization through vendors and software providers long before security teams deploy it directly, and annual questionnaires can’t keep pace with how quickly that changes.

📋 What the AI Act’s risk-based approach actually requires, and when

🔍 Why AI exposure often lives several layers deep in your vendor ecosystem

🔄 Why continuous oversight matters more than a once-a-year compliance check

👉 Read the full blog and see what it takes to track AI exposure across your supply chain: https://securityscorecard.com/blog/how-the-eu-ai-act-changes-vendor-risk-management/?utm_campaign=&utm_content=&utm_medium=social&utm_source=facebook

If you're investigating PHP you're likely asking if you're exposed or which vendors put you at risk — or what should we ...
10/22/2026

If you're investigating PHP you're likely asking if you're exposed or which vendors put you at risk — or what should we fix first?

SecurityScorecard’s MAX team will help you answer those questions about PHP2Shell (CVE-2026-109618 and CVE-2026-109619) this week and next, for free. We will help identify potential exposure across your organization and vendors, and you don’t need to be a customer. Email [email protected].

Here is why it matters. SecurityScorecard’s STRIKE team found approximately 6 million internet-facing IPs running PHP. 🚨

🌐 7,669,724 distinct IPs showed PHP in a 30-day windownbsp;

⚠️ 2,705,148 IPs advertised a PHP version below the upstream fixnbsp;

🇺🇸 The United States leads with 1.69 million PHP-tagged IPs, ahead of France and Germany

👉 Read the blog and get the full data, plus a five-step plan to patch, restart, and verify every PHP runtime, and reach out if you need support: https://securityscorecard.com/blog/patch-the-runtime-then-verify-the-footprint/

Aviation averages a B grade for cybersecurity. That sounds fine, until you learn a B-rated organization is 2.9x more lik...
10/17/2026

Aviation averages a B grade for cybersecurity. That sounds fine, until you learn a B-rated organization is 2.9x more likely to suffer a breach than an A-rated one.

SecurityScorecard’s research on 250 major aerospace and aviation companies found the real problem isn’t the airlines themselves.

It’s their vendors: aviation-specific software and IT suppliers scored the lowest of any group studied, dragging the sector’s average down.

✈️ Why a handful of low-scoring vendors are wrecking the curve for an entire industry

📋 Why annual questionnaires can’t catch a vendor exposure that appears mid-year

🏛️ Why TSA and FAA oversight are now asking for proof, not paperwork

👉 Read the full breakdown and see what continuous, threat-informed TPRM looks like for aviation: https://securityscorecard.com/blog/airlines-are-flying-blind-on-third-party-cyber-risk/?utm_campaign=&utm_content=&utm_medium=social&utm_source=facebook

“People who design systems, people who build systems, they usually believe that people will be well behaved,” our CEO an...
10/16/2026

“People who design systems, people who build systems, they usually believe that people will be well behaved,” our CEO and Co-Founder Dr. Aleksandr Yampolskiy told Cybersecurity Dive. “But hackers are not well behaved.”

Days after the French supermarket refrigeration attacks, Cybersecurity Dive reports that thousands of controllers remain exposed globally.

SecurityScorecard’s own investigation found more than 5,200 StoreView instances visible across more than 4,600 public IP addresses, a wider footprint than any single headline captured.

👉 Read the full Cybersecurity Dive coverage: https://www.cybersecuritydive.com/news/thousands-refrigerator-devices-exposed-french-cyberattack/833117/

10/16/2026

A doctor checks your blood pressure. Your car has a speedometer. Buy a financial instrument, and you get a credit rating from S&P or Moody’s. What about for cybersecurity?

Our CEO and Co-Founder Dr. Aleksandr Yampolskiy explains how he pioneered security ratings, the idea behind SecurityScorecard on The Vlad Kachur Show: a security score for any company, so you can actually see the risk before you do business with them.

📺 Watch the full episode: https://www.youtube.com/watch?v=3OYUrYq9LOE

We’re proud to be participating in TPRA’s October 2026 Virtual Demo Day, an exclusive event for TPRM professionals to ex...
10/15/2026

We’re proud to be participating in TPRA’s October 2026 Virtual Demo Day, an exclusive event for TPRM professionals to explore innovative tools and services in third-party risk management.

Join Michelle Koestani, Director, Solutions Architects at SecurityScorecard for a 25-minute live demo, where she’ll showcase how TITAN AI helps TPRM teams move from periodic assessments to continuous, threat-informed risk management.

Her session is at 12:00 PM CT.

🔍 See how continuous monitoring surfaces vendor risk as it emerges

⚙️ Learn how AI agents automate manual questionnaire work

🎯 Get a clear view of your entire vendor ecosystem, not just your top-tier vendors

📅 Wednesday, October 21, 2026 | Starting at 9:00 AM CT
👉 Register here: https://www.tprassociation.org/demo-days

A 200-question spreadsheet sent to every vendor regardless of risk level isn’t enough to stay ahead of third-party cyber...
10/15/2026

A 200-question spreadsheet sent to every vendor regardless of risk level isn’t enough to stay ahead of third-party cyber risk.

SecurityScorecard’s new eBook breaks down why legacy TPRM tools can’t keep pace anymore: biannual assessment cycles, massive questionnaires, and manual evidence review create six-week delays while third-party involvement in breaches has climbed from 30% to 48% year-over-year.

📋 Why checkbox-driven assessment cycles fail to catch changing threats

⏱️ The hidden cost of questionnaire fatigue: delayed assessments and disconnected tools

🤖 How AI-driven automation and continuous monitoring close the visibility gap

👉 Get the eBook and see what it takes to modernize your vendor risk workflow to match the pace of real threats: https://securityscorecard.com/resources/ebook/ai-powered-tprm-an-answer-to-endless-questionnaires/?utm_campaign=&utm_content=&utm_medium=social&utm_source=facebook

Takedowns once cost attackers weeks of rebuilding. Now they only cost minutes.Richard Hummel and Gilad Friedenreich Maiz...
10/15/2026

Takedowns once cost attackers weeks of rebuilding. Now they only cost minutes.

Richard Hummel and Gilad Friedenreich Maizles broke down how SecurityScorecard’s STRIKE team uncovered CanOworms, a 633-server proxy fleet for rent, and why law enforcement takedowns rarely stick against infrastructure like this.

One single IP can host 10,000 domains, leased for as little as three hours. When attackers lose infrastructure, underground LLMs can rebuild it automatically in minutes.

🔍 Why tracking TCP flag anomalies and TLS fingerprints beats chasing IP reputation
🔄 Why one open-source tip from a partner led researchers to 633 servers
🛡️ The specific actions defenders should prioritize right now

👉 Read the full recap: https://securityscorecard.com/blog/canoworms-how-to-evict-hackers-for-rent-infrastructure/?utm_campaign=&utm_content=&utm_medium=social&utm_source=facebook

Address

1140 Avenue Of The Americas/19th Floor
New York, NY
10036

Opening Hours

Monday 8:30am - 7pm
Tuesday 8:30am - 7pm
Wednesday 8:30am - 7pm
Thursday 8:30am - 7pm
Friday 8:30am - 7pm

Telephone

(800) 682-1707

Website

Alerts

Be the first to know and let us send you an email when SecurityScorecard posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to SecurityScorecard:

Shortcuts

Share

Category