SecurityScorecard

1.1 Identity, Mission, and Platform

SecurityScorecard, Inc. is a privately held, Delaware-incorporated cybersecurity company headquartered at 1140 Avenue of the Americas, 19th Floor, New York, NY 10036, with a secondary office in Austin, Texas, and a globally distributed workforce. The company was founded in 2013 by Dr. Aleksandr Yampolskiy and Sam Kassoumeh and formally incorporated in New York on July 17, 2014 (Document No. 4607959 per the New York Department of State). It remains private with unicorn status from the March 2021 Series E at a $1B post-money valuation. The company's stated mission is to make the world safer by transforming how organizations understand, mitigate, and communicate cybersecurity risk to their boards, employees, and vendors. The platform's core product is a patented security ratings engine that collects externally observable signals — internet scanning, DNS health, IP reputation, network configuration, and endpoint observations — and aggregates them into A-to-F letter scores across ten risk factor groups, requiring no on-premises agent or vendor-submitted questionnaire. This "outside-in" approach allows SecurityScorecard to continuously rate millions of organizations without their knowledge or consent. From that ratings foundation, the company has expanded into a broader Supply Chain Detection and Response (SCDR) platform covering vendor risk management (TPRM), external attack surface management, self-monitoring, board reporting, cyber insurance underwriting, M&A due diligence, threat intelligence, and digital forensics and incident response. The March 2026 TITAN AI launch further extends the platform with AI-accelerated questionnaire automation and threat-informed remediation workflows. SecurityScorecard is recognized by CISA as a free cyber tool and service, and as of March 2026 the platform continuously rates over 12 million organizations globally.[CO001, CO002, CO003, CO004, CO005, CO006]

1.2 Founders, Leadership, and Governance

SecurityScorecard was co-founded by Dr. Aleksandr Yampolskiy and Sam Kassoumeh, both of whom remain active at the company. Dr. Yampolskiy holds a Ph.D. in Cryptography from Yale University (2006) and a B.A. in Mathematics and Computer Science from New York University. Before founding SecurityScorecard he was CISO at Gilt Groupe (where he scaled the security function from 200 to 2,500 employees), CTO at Cinchcast/BlogTalkRadio (scaling to 30M+ monthly visitors), and held engineering and security leadership roles at Goldman Sachs and Oracle. His direct prior experience as CISO managing third-party vendor risk at Gilt Groupe is the founding motivation for SecurityScorecard's core use case. He was named E&Y Entrepreneur of the Year 2021 in New York and Cyber Defense Magazine's CEO of the Year 2021. Sam Kassoumeh, co-founder, serves as Head of Product and is a board member; a third-party database lists him as COO, reflecting an ambiguous public title. Board governance includes investor representatives from key backers: Karim Faris (General Partner, GV / Google Ventures), Joe De Pinho (Principal, Riverwood Capital), Upal Basu (General Partner, NGP Capital), and Richard Seewald (Managing Partner, Evolution Equity Partners). Nick Donofrio, IBM Fellow Emeritus, adds enterprise technology governance experience. Dan Streetman, CEO of Tanium, joined the board as an independent director in January 2026. Key-person risk is meaningfully concentrated in Dr. Yampolskiy as CEO, public face, and co-inventor of the core technology; no succession plan has been publicly disclosed. A full current board roster, committee assignments, and director independence disclosures are not publicly available via official company materials, which represents a material diligence gap for any governance assessment.[CO011, CO012, CO013, CO014, CO015, CO016]

1.3 Funding History and Capitalization

SecurityScorecard's disclosed capital history spans seven rounds from seed to Series E. The earliest documented funding was a seed round of approximately $2.2M in 2014, followed by a $13.7M Series A in February 2015. The company then raised a Series B (approximately $20M, June 2016) and Series C (approximately $27.5M, October 2017), building out its ratings platform and initial go-to-market. A Series D of approximately $50M in June 2019 funded international expansion and product adjacencies. The definitive financing event was the March 18, 2021 Series E: a $180M preferred stock round that brought total disclosed funding to over $290M and established a $1B post-money valuation, making SecurityScorecard a unicorn. J.P. Morgan Securities LLC served as sole placement agent for the Series E. No additional public funding rounds, IPO plans, secondary transactions, or debt facilities have been disclosed since. New Series E investors included Silver Lake Waterman, T. Rowe Price Associates, Kayne Anderson Rudnick, and Fitch Ventures (a Fitch Group subsidiary signaling strategic interest from a competing ratings business). Existing investors also participated: Evolution Equity Partners, Accomplice, Riverwood Capital, Intel Capital, NGP Capital, AXA Venture Partners, GV (Google Ventures), and Boldstart Ventures. PitchBook and Tracxn report cumulative raised of approximately $293M as of 2026. The investor base is notable for including both financial sponsors (Silver Lake, Sequoia, Riverwood) and strategics (GV/Google, Intel Capital, Fitch Ventures, AXA Venture Partners), implying diverse exit expectations. Exact cap table ownership percentages and liquidation preferences are not publicly disclosed.[CO021, CO022, CO023, CO024, CO025, CO026]

1.4 Scale, Revenue, and Customer Footprint

SecurityScorecard's scale has expanded substantially since the 2021 Series E. The company closed 2023 with 2,600 paying customers and 70,000 organizations actively using the platform. By March 2026, its official company page and TITAN AI press release both confirmed over 3,300 direct customer organizations, with 70% of the Fortune 100 trusting its data. The platform continuously monitors more than 12 million organizations — a figure that represents the global reach of the ratings data set rather than paying customers. SecurityScorecard's MAX managed services offering was growing at triple-digit rates as of October 2025, and in Q4 2020 the company reported international recurring revenue growth of 61% YoY and international customer count growth of 89% YoY. At the March 2021 Series E, the company had nearly 2 million monitored organizations. Revenue disclosure is limited to a single data point: the October 2025 SAFE-SSC joint press release stated that SecurityScorecard had exceeded $150M ARR, with MAX growing at triple-digit rates. No subsequent ARR update, gross margin, or revenue growth rate has been publicly disclosed. Headcount is estimated by third-party aggregators at 615-639 employees for 2026; the Forbes Council profile cited "over 600 employees." Official headcount figures are not published. Geographic presence beyond New York City and Austin, Texas relies on company statements about a globally distributed workforce. Exact current ARR, gross margin, and quarterly revenue growth remain private company metrics.[CO031, CO032, CO033, CO034, CO035, CO036]

1.5 Milestones and Strategic Trajectory

SecurityScorecard's evolution follows three phases: category creation (2013-2019), institutional scale and unicorn certification (2019-2022), and platform diversification and AI transformation (2023-present). In the first phase, the founders built the outside-in ratings engine, raised through Series D, and validated market demand across financial services, insurance, and enterprise technology. The second phase culminated in the $180M Series E, LIFARS acquisition (February 2022 — adding 50+ DFIR employees and incident response capability), and the company crossing 2 million monitored organizations. The Forrester Wave Leader designation in Q1 2021 and Gartner Peer Insights Customers' Choice in 2021 corroborated the ratings market leadership claim. The third phase is defined by platform breadth and regulatory adoption. In 2023 SecurityScorecard acquired CVEDetails (vulnerability database, 350K+ monthly users), launched MAX managed services, integrated generative AI as the first security ratings platform to do so, and achieved FedRAMP Ready designation plus DHS CDM Program approval — opening a meaningful government revenue channel. Strategic partnerships with Microsoft (Security Copilot), AWS (Level 1 MSP), and S&P Global (Supplier Risk Index) expanded distribution. In September 2025 HyperComply was acquired to automate vendor questionnaires. At RSA Conference 2026 on March 23, TITAN AI launched with three tiers — TITAN Watch (continuous monitoring), TITAN Assess (AI questionnaire automation), and TITAN Secure (threat-informed remediation) — claiming a 95% reduction in manual TPRM effort and 75% fewer supply chain breaches for adopters. The 2025 Global Third-Party Breach Report, based on 1,000 analyzed breaches, found 35.5% of 2024 data breaches were third-party-related (up 6.5% YoY), providing market context for the platform's value proposition.[CO039, CO040, CO041, CO042, CO043, CO044]

1.6 Adverse Events, Litigation, and Risk Considerations

The most significant adverse event in SecurityScorecard's history is the June 2024 trade secret lawsuit against Safe Security and former employee Mary Polyakova (case 1:24-cv-04240, S.D.N.Y., Judge Edgardo Ramos presiding). SecurityScorecard alleged that Polyakova, a senior sales executive who spent four years in its sales organization, emailed the "Master East List" and "CISO Prospect Lists" — confidential customer and prospect data valued at more than $40M — to her personal account before joining Safe Security as VP of Central Sales in May 2024. The complaint further alleged that Safe Security used fake accounts and shell domains to access the SecurityScorecard platform for competitive intelligence and conducted fake job interviews with SecurityScorecard employees to extract proprietary business information. SecurityScorecard said it had invested more than $200M in developing its customer and prospect base. During the litigation, Safe Security's CEO Saket Modi publicly countered that SecurityScorecard and comparable competitors were "laying off significant portions of their teams because of the poor performance of their business." This claim — originating from an adverse party in active litigation — has not been independently confirmed by WARN Act filings, workforce aggregator data, or independent news reporting for 2024-2026. SecurityScorecard disputed it. Both companies resolved the dispute in October 2025 and announced a mutual research collaboration in cyber risk management, ending the litigation before trial. No other material lawsuits, regulatory enforcement actions, or sanctions have been found in accessible public records as of the run date.[CO049, CO050, CO051, CO052, CO053, CO054]

1.7 Exhibits

2.1 Market Boundary, Taxonomy, and Adjacent Spend

SecurityScorecard competes at the intersection of three overlapping software categories: cyber risk ratings (also called security ratings or cyber risk scoring), third-party risk management (TPRM) platforms, and external attack surface management (EASM). The core differentiator of the ratings category is the "outside-in" continuous scoring methodology— observable internet signals aggregated into A–F letter grades without on-premises agents or vendor participation—which provides automated coverage of millions of organizations at once. The primary included spend is enterprise software subscription revenue for platforms that monitor external cyber posture and vendor/supply-chain risk: security ratings feeds, TPRM workflow software, questionnaire automation, continuous vendor monitoring, and AI-assisted remediation orchestration. Closely adjacent budgets include: governance, risk and compliance (GRC) software (which often houses TPRM workflows), external attack surface management tools (which compete and complement on the scanning side), cyber insurance underwriting technology (which uses security ratings to price policies), and board-level cyber risk reporting dashboards. Together these adjacent categories add approximately $23–35B in software spend that overlaps with SecurityScorecard's platform scope. Excluded from the core TAM are internal network security products (firewalls, endpoint detection, SIEM), identity and access management, and the broader $244B global information security market estimated by Gartner for 2026. Substitutes for security ratings include one-time penetration tests, ad hoc questionnaire-only programs (often Excel-based), managed security service providers handling vendor assessments, and internal security teams conducting point-in-time audits. The critical boundary distinction is that SecurityScorecard's outside-in continuous rating model replaces periodic, labor-intensive assessments—a distinct value proposition that separates the product from traditional GRC checkbox tools, though that boundary is blurring as larger GRC platforms add continuous monitoring features.[CM001, CM002, CM003, CM004, CM005, CM006]

2.2 Market Sizing — Multiple Lenses and Contradictory Estimates

Analyst estimates for the global TPRM software market in 2026 vary substantially depending on definition scope: Grand View Research puts the 2023 base at $7.42B growing to $20.59B by 2030 at a 15.7% CAGR; SkyQuest estimates $11.11B for 2025 scaling to $37.44B by 2033 at 16.4%; Business Research Insights places the 2026 market at $10.36B scaling to $45.98B by 2035 at 18.2%. The spread—roughly $8–11B for a 2026 point estimate—reflects different definitions of "TPRM" (pure software vs. managed services included), different geographies, and varying treatment of adjacent categories like GRC and EASM. The external attack surface management sub-segment that overlaps with SecurityScorecard's ratings engine is projected at $930.7M by 2026 at a 17.5% CAGR, while the broader attack surface management market (including internal ASM) is estimated to grow from $1.43B in 2024 to $9.19B by 2032 at a 30.4% CAGR. GRC software, which houses TPRM workflows for many large enterprises, is separately estimated at $23.32B in 2026 growing to $39.01B by 2031 at a 10.84% CAGR. Cyber insurance premiums reached approximately $15.3–19.6B in 2025–2026 and represent an adjacent demand pool: insurers increasingly require security ratings as underwriting inputs, creating a derived demand signal for ratings providers. Constructing a bottoms-up SAM for SecurityScorecard requires isolating the software portion of TPRM (approximately 59% of market per Grand View Research), the North American and European share (roughly 70% combined), and the enterprise-grade portion excludes SME self-serve. Applying these filters to the $10–11B TPRM total yields a serviceable addressable market of approximately $4–7B. SecurityScorecard's reported $150M+ ARR implies roughly 2–4% penetration of this SAM, consistent with an early-to-mid growth stage. The contradictory sizing estimates are preserved in Table TM002 as required by quality policy.[CM008, CM009, CM010, CM011, CM012, CM013]

2.3 Buyer, User, and Payer Segmentation

The primary economic buyer for SecurityScorecard is the Chief Information Security Officer (CISO), who owns the security strategy, vendor risk program, and board-level cyber risk reporting. A 2026 Panorays survey of 200 CISOs found that 85% lack full supply chain visibility and 62% report increased regulatory pressure over the prior 12 months, validating the problem urgency. However, only 22% of CISOs feel "fully prepared" to meet evolving regulatory requirements, creating a large addressable buyer segment that is motivated but underserved by current tools. The user persona is typically the Third-Party Risk Manager or vendor risk analyst within the CISO's organization, who uses the platform daily for vendor onboarding, continuous monitoring, and remediation tracking. Payers vary significantly: in regulated industries (BFSI, healthcare), TPRM budgets are often carved from a dedicated GRC or compliance budget; in technology companies, spend flows from a security engineering budget; in mid-market firms, the CISO's discretionary budget covers all. Secondary buyers include procurement/vendor management teams (who control vendor contract terms and may embed security scoring requirements into RFPs), cyber insurance underwriters (who use SecurityScorecard ratings as underwriting inputs to price policies and set terms—a B2B2B demand chain), and boards/audit committees (who consume risk dashboards and increasingly require third-party risk metrics as part of SEC and NIS2 governance disclosures). Enterprise large ($1B+ revenue) companies with 500+ vendor relationships represent the primary segment; Panorays data shows only 41% of organizations even monitor fourth-party vendors, indicating significant adoption gap among the mid-market.[CM018, CM019, CM020, CM021, CM022, CM023]

2.4 Growth Drivers — Regulation, Threat Escalation, and AI

The three strongest growth drivers for the cyber risk ratings and TPRM market in 2026 are: (1) regulatory mandates, (2) supply chain threat escalation, and (3) AI-driven automation expanding the ROI case. On regulation: NIS2 (EU) covers 18 critical sectors, required transposition by October 2024, and in January 2026 the EU Commission proposed targeted amendments to ease compliance for 28,700 companies. DORA (EU financial resilience) became effective in January 2025 and requires financial entities to manage ICT third-party risk continuously. The SEC's July 2023 Cybersecurity Disclosure Rule requires public companies to report material incidents within four business days and disclose third-party risk management governance in annual 10-K filings—creating board-level demand for auditable TPRM programs. Together these three frameworks directly mandate or strongly incentivize the continuous vendor monitoring that security ratings provide. On threats: Third-party involvement in breaches doubled to approximately 30% of all breaches in 2025 (Verizon DBIR), and SecurityScorecard's own 2025 research documented 35.5% of 2024 breaches as third-party related. Black Kite's 2026 report found that each vendor breach now cascades to an average of 5.28 downstream organizations—the highest ever recorded—while 41.4% of ransomware attacks now originate through third-party vectors. Global supply chain attack costs reached an estimated $60B in 2025. On AI: TITAN AI's March 2026 launch claims 95% reduction in manual TPRM effort, validating the automation ROI thesis. Gartner projects the AI-amplified security market will reach $160B by 2029, and 75%+ of enterprises will use AI-amplified cybersecurity products by 2028. This creates both an expansion of the addressable market (AI unlocking mid-market buyers who previously couldn't staff TPRM programs) and a competitive advantage for vendors who embed AI early in their platforms.[CM025, CM026, CM027, CM028, CM029, CM030]

2.5 Adoption Constraints, Market Friction, and Adverse Signals

Despite strong growth tailwinds, the cyber risk ratings and TPRM market faces structural adoption constraints. The most frequently cited limitation is data quality and false positives: security ratings rely on outside-in passive scanning, which can misattribute assets or flag deprecated infrastructure as active vulnerabilities. PeerSpot buyer reviews note that SecurityScorecard's mindshare in IT Vendor Risk Management declined from 11.1% to 5.7% between 2025 and 2026, and BitSight's declined from 10.8% to 5.8%—suggesting category fragmentation rather than leader dominance. The 66% of CISOs who find GRC tools "only somewhat effective" reflects broad buyer dissatisfaction across the entire TPRM category, not just ratings-specific tools. Budget cyclicality is a structural constraint: enterprise security budgets are discretionary above regulatory minimums, and ISC2's 2024 data showed 37% of organizations faced security budget cuts and 25% experienced cybersecurity layoffs. Platform consolidation creates a displacement risk: Palo Alto Networks, Microsoft, and CrowdStrike are expanding their GRC and risk management capabilities, potentially absorbing TPRM features into existing enterprise agreements. The Gartner 2026 security spending forecast ($244.2B total, growing 13.3%) encompasses all of cybersecurity, and the TPRM segment's growth must compete with higher-urgency categories like cloud security (28.8% growth) and endpoint security. Procurement friction is a persistent constraint: enterprise security deals typically require CISO sponsorship, legal/procurement review, security questionnaire responses from the vendor, and multi-quarter evaluation cycles. The 79% of CISOs who lack a formal incident response plan for third-party breaches (Panorays) indicates that the market is still in an education and urgency-building phase, with many organizations recognizing the problem but not yet budgeting for continuous platform solutions. Cyber insurance market softening (global insurance pricing fell ~7% in Q4 2025) may reduce insurance-driven urgency for security improvement in the near term.[CM034, CM035, CM036, CM037, CM038, CM039]

2.6 Exhibits

3.1 Competitive Landscape Overview

SecurityScorecard operates in a crowded and intensifying competitive field spanning three distinct segments: direct cyber risk ratings peers (BitSight, UpGuard, Mastercard RiskRecon, Black Kite, Panorays), adjacent GRC and workflow platforms (OneTrust Vendorpedia, ProcessUnity/CyberGRX, ServiceNow VRM, Archer), and macro substitutes including internal-build programs and status-quo annual-questionnaire processes. The 2026 Forrester Wave for Cybersecurity Risk Ratings named BitSight and Panorays as Leaders, with SecurityScorecard absent from that designation — a competitive differentiation signal that enterprise buyers will notice. In parallel, Gartner published its inaugural Magic Quadrant for TPRM Tools for Assurance Leaders (2026), naming OneTrust, Diligent, Optro, Certa, and Aravo as Leaders in the adjacent GRC workflow category. These analyst placements reflect a bifurcation: ratings-centric buyers evaluating BitSight vs. SecurityScorecard, and workflow-centric buyers evaluating GRC suites that bundle ratings via API. With Moody's backing BitSight with a $250M strategic investment and UpGuard closing a $75M Series C in February 2026, capitalization has increased across all primary direct competitors, intensifying product investment and sales capacity. The convergence of AI-driven automation, regulatory pressure, and insurance integration is drawing every competitor in the field toward similar capability sets, compressing differentiation timelines.[CP001, CP002, CP007, CP022, CP036]

3.2 Direct Competitor Profiles

BitSight is SecurityScorecard's primary direct competitor. Backed by a $250 million Moody's strategic investment, BitSight surpassed $200 million in ARR by 2025 and rates signals on over 350 million organizations globally through its Moody's integration. Its insurance segment grew 30% year-over-year in H1 2026, cementing its position as the preferred ratings provider among insurers and financial-services firms. The Forrester Wave Q2 2026 awarded BitSight the highest scores in 11 criteria categories — the most of any evaluated vendor. On Gartner Peer Insights, BitSight scores 4.6/5 (264 reviews) versus SecurityScorecard's 4.4/5 (278 reviews), a narrow but directionally meaningful gap in enterprise evaluation cycles. BitSight's Moody's partnership also provides access to credit-risk data integration, giving it a unique cross-asset risk view that SecurityScorecard does not currently replicate. UpGuard raised $75 million in a Series C round in February 2026 (led by Springcoast Partners, total raised over $120 million), and has held the No. 1 TPRM spot on G2 for 15 consecutive quarters. The platform processes over 100 billion risk signals daily, serves 50,000 plus organizations in more than 90 countries, and targets mid-market and enterprise buyers with a unified Cyber Risk Posture Management approach combining vendor risk, breach monitoring, and compliance under one AI-driven system. UpGuard is the leading challenger for mid-market displacement of SecurityScorecard, competing primarily on ease-of-use and total cost of ownership rather than ratings breadth. Mastercard RiskRecon claims a 99.1% asset validation rate and differentiates through Mastercard global threat intelligence integration, AI-assisted deep asset discovery, and a 2026 partnership ecosystem including Cloudflare and Recorded Future for enhanced attack surface monitoring. It is strongest in regulated financial-services verticals, where Mastercard brand trust accelerates procurement approval. Black Kite raised $22 million in a 2021 Series B and serves approximately 3,000 enterprise customers globally. Its Ransomware Susceptibility Index (RSI) and Open FAIR financial quantification differentiate it for buyers seeking business-contextualized risk metrics, particularly risk quantification in dollar terms. Mid-market pricing starts around $29,000 annually, making it more accessible than SecurityScorecard for price-sensitive buyers. Panorays, a Forrester Wave Q2 2026 Leader, serves over 1,000 customers globally and differentiates on AI-driven agentic workflows, real-time multi-tier supply chain mapping, and integrated questionnaire-plus- ratings in a single user experience. Its 2026 CISO survey of 200 US-based security leaders found that 85% lack full third-party threat visibility and only 41% monitor beyond Tier-1 suppliers, a market pain point Panorays specifically targets with nth-tier mapping capability.[CP001, CP002, CP003, CP004, CP005, CP006]

3.3 Adjacent and Workflow Substitutes

Beyond direct ratings peers, SecurityScorecard faces competition from GRC and workflow platforms that embed ratings functionality through native modules or API integrations, effectively substituting standalone ratings products within larger enterprise software contracts. OneTrust was named a Leader in the inaugural Gartner Magic Quadrant for TPRM Tools for Assurance Leaders (2026), scoring 8.4 out of 10 on Gartner Peer Insights with a 78% willingness-to-recommend rate. It competes strongly in privacy-adjacent and compliance-driven programs where GRC and TPRM are consolidated into a single vendor contract. ServiceNow VRM targets large enterprises with deep ITSM integration needs. While it typically requires specialized consulting for implementation, its installed-base scale creates bundling risk — when TPRM is absorbed into an existing ServiceNow contract, a standalone ratings layer is no longer needed. ProcessUnity's CyberGRX integration with ServiceNow delivers crowd-sourced third-party risk intelligence into existing ServiceNow workflows, enabling procurement teams to access peer-validated risk data without a separate ratings tool. Interos focuses on nth-tier supply chain visibility and vendor relationship mapping, targeting supply chain intelligence use cases rather than traditional outside-in ratings methodology. Recorded Future and Google Mandiant compete on threat intelligence that overlaps with EASM and ratings data in security-operations-centric programs. Incumbents such as RSA Archer and MetricStream address mature GRC programs that may embed ratings through integrations. All of these platforms represent pipeline threats for SecurityScorecard, particularly when a buyer is already standardized on a large enterprise software stack and needs only marginal ratings capability. The Gartner TPRM MQ naming five GRC-category Leaders with no traditional ratings vendor among them signals that the workflow layer may commoditize the ratings layer over time, drawing budget away from standalone products.[CP021, CP022, CP023, CP024, CP025, CP026]

3.4 SecurityScorecard's Differentiation and Moat

SecurityScorecard's principal competitive advantages are organizational scale, insurance ecosystem integration, product breadth, and data network effects. Its outside-in ratings engine continuously rates over 12 million organizations — a coverage footprint no direct competitor currently matches at comparable active-monitoring scope. The TITAN AI platform, launched in March 2026, claims a 75% reduction in supply-chain breaches and 9x higher vendor engagement, automating more than 95% of TPRM manual tasks including questionnaires, evidence collection, remediation planning, and report generation. The September 2025 acquisition of HyperComply reinforces this by adding AI-powered questionnaire automation that reduces manual effort by 92% and accelerates questionnaire response times by more than 70%. These claims are vendor-asserted and have not been independently benchmarked. The insurance ecosystem integrations create meaningful switching cost. The Aon partnership (March 2026) integrates SecurityScorecard's outside-in ratings with Aon's CyQu cyber insurance platform, enabling dynamic underwriting based on continuously updated ratings data. The April 2025 Willis partnership designated Willis as SecurityScorecard's official insurance broker, creating embedded distribution into one of the largest global insurance brokerage networks. Combined with CVEDetails, the MAX questionnaire platform, and the unified TITAN AI agent layer, SecurityScorecard is building a multi-product stack with compounding switching costs. Buyers who embed SecurityScorecard ratings into underwriting workflows, supply-chain onboarding, and regulatory disclosure reporting face high replacement friction. The data network effect — 12 million plus rated organizations means every new customer benefits from broad coverage while contributing signal data that improves accuracy for all participants — is an architectural moat that late entrants would need years to replicate.[CP028, CP029, CP030, CP031, CP032, CP033]

3.5 Competitive Weaknesses and Adverse Signals

Despite scale advantages, SecurityScorecard has documented competitive vulnerabilities. Most fundamentally, its outside-in-only methodology is criticized for generating false positives when external asset attribution is incorrect or when internal compensating controls are invisible to external scanners. Competitor-authored analyses and independent reviews document cases where the scanner misattributes assets to the wrong organization, resulting in score reductions that vendors must contest through a dispute process. FortifyData, a competing risk management platform, explicitly cites this attribution limitation as a reason customers may prefer platforms that supplement outside-in data with questionnaire-based or insider information. SecurityScorecard claims its false-positive rate is below 1% and offers a rapid dispute resolution process (typically within 72 hours), but this metric is company-asserted and not independently verified. SecurityScorecard did not receive a Leader designation in the Forrester Wave Q2 2026 for Cybersecurity Risk Ratings, while BitSight and Panorays did. This creates a reputational positioning gap in competitive sales cycles where analyst recognition influences enterprise procurement shortlists. In the insurance vertical specifically, BitSight's 30% year-over-year insurance segment growth in H1 2026 suggests it has been gaining share against all peers including SecurityScorecard. Pricing opacity — enterprise contracts are custom-negotiated and module-based, with no publicly listed pricing for the full platform — creates budgetary uncertainty for mid-market buyers and is a recurring theme in independent reviews. The SAFE Security legal dispute (trade secret litigation, status partially unresolved as of the report date) introduces brand risk as methodology credibility becomes a sales objection in competitive evaluations.[CP034, CP035, CP036, CP037, CP038, CP041]

3.6 Win/Loss Dynamics by Buyer Segment and Geography

SecurityScorecard wins most reliably in large enterprise accounts where broad supply-chain vendor coverage, regulatory defensibility (SEC 10-K, NIS2, DORA disclosures), and insurance integration are the primary buying criteria. Enterprise CISOs managing thousands of vendors across global supply chains — who need a ratings provider whose scores are accepted by insurers and auditors — represent SecurityScorecard's clearest win profile. The Aon and Willis integrations create downstream channel pull: when an insurer quotes cyber coverage using SecurityScorecard data, the insured organization has a natural incentive to adopt the platform for proactive score improvement and remediation tracking. Losses concentrate in mid-market accounts and in deals where integrated workflow, ease of deployment, and total cost of ownership dominate over ratings breadth. UpGuard wins mid-market deals where buyers want a bundled questionnaire-plus-ratings experience at a more accessible price point. Panorays wins where AI-driven supply-chain mapping and multi-tier visibility are the primary differentiator. BitSight wins in financial services and insurance where its Moody's-backed statistical methodology is the recognized industry standard for insurance risk modeling. Geographic differentiation is difficult to verify from public sources; SecurityScorecard's multi-language platform (including 2026 Korean language support) and global ratings footprint signal active international expansion, but revenue concentration by region is not publicly disclosed. In procurement evaluations that include analyst scorecards, Forrester's Q2 2026 designation of BitSight and Panorays as Leaders may shift enterprise shortlists, requiring SecurityScorecard to defend based on unique use-case strengths rather than analyst parity. The emergence of large-suites bundling is an additional structural risk: if an enterprise standardizes on OneTrust or ServiceNow, a ratings module in the contract displaces the need for a standalone SecurityScorecard subscription.[CP039, CP040, CP041, CP042, CP043]

3.7 Exhibits

4.1 Revenue Model and ARR Trajectory

SecurityScorecard's disclosed revenue history is sparse but directionally positive. Third-party SaaS databases estimate ARR grew from approximately $71M in 2021 to $88.5M in 2022 (roughly 25% YoY), $106M in 2023 (~20% YoY), and $144.3M in early 2024 (~36% YoY)—representing an implied four-year CAGR of approximately 27%. The only company-disclosed figure is the $150M+ ARR milestone announced in October 2025 as part of a joint press release with Safe Security resolving a trade secret lawsuit. No standalone investor release, earnings call, or audited filing has confirmed this figure, limiting its auditability. No subsequent public ARR update has been issued as of June 2026, creating a growing freshness gap. The company's recurring revenue model is anchored in annual SaaS subscriptions for security ratings, third-party risk monitoring, and supply chain detection capabilities. These subscriptions generate predictable ARR with renewal dynamics typical of enterprise security software—though exact NRR and gross churn are not publicly available. Revenue recognition follows standard SaaS contract recognition; no deferred revenue complications or consumption-based anomalies have been disclosed. Given 3,300+ enterprise customers and $150M+ ARR, the implied average contract value is approximately $45,000 per customer per year—consistent with enterprise TPRM pricing benchmarks. [CI001, CI002, CI003, CI031, CI032, CI033]

4.2 Product Revenue Mix and Emerging Growth Streams

SecurityScorecard's revenue mix spans four observable streams: (1) core SaaS subscription revenues from security ratings and TPRM platform access, which represent the majority of ARR; (2) MAX managed services, a high-velocity growth layer delivered through certified service partners; (3) TITAN AI questionnaire automation revenues, accelerated by the September 2025 HyperComply acquisition; and (4) insurance underwriting and data licensing revenues through partnerships with WTW and expanding broker relationships. MAX managed services is the standout growth signal. The product grew 370% YoY as of mid-2025 and contributed to triple-digit growth in the most recent quarter. Channel ARR—revenue flowing through the partner ecosystem—grew 160% YoY in 2025, and partner-led pipeline increased 126% YoY. With 600+ partners and 35 new partners added in 2025, the channel is becoming a structurally important distribution mechanism. The HyperComply acquisition adds questionnaire automation as a product capability; whether it is priced as a standalone add-on or bundled into enterprise tiers is not publicly disclosed. The insurance underwriting use case, referenced repeatedly in press materials and supported by WTW and other broker relationships, represents an emerging data-monetization channel whose contribution to total ARR is not quantified. International revenue is growing—Q4 2020 saw 61% YoY international recurring revenue growth and 89% international customer count growth—but no recent geographic revenue breakdown has been published. [CI004, CI005, CI006, CI007, CI008, CI009]

4.3 Pricing Architecture and Contract Economics

SecurityScorecard's pricing is tiered but opaque above the entry level. The Free tier provides self-assessment access. The Business plan covers monitoring of up to five external entities and is priced at approximately $15,000–$25,000 per year based on third-party procurement data. The Enterprise plan covers a custom number of monitored scorecards with advanced alerting, compliance frameworks, and a dedicated customer success manager; pricing is "Contact Sales" only, with third-party benchmarks suggesting typical enterprise contracts of $50,000–$100,000+ per year. The MAX tier—which adds managed services, remediation support, and breach detection—carries fully custom pricing estimated at $100,000+ per year for meaningful deployments. Multiple add-ons (Cyber Risk Quantification, Attack Surface Intelligence API, Automatic Vendor Detection) sit outside the base Enterprise subscription, potentially materially increasing total contract value. The per-user pricing benchmark cited in procurement databases is approximately $20,000/user/year for smaller deployments, scaling non-linearly for large organizations. Multi-year discounts are available but not systematically disclosed. SecurityScorecard's competitive displacement wins in the October 2025 press release involved "six-figure" contracts, confirming that the largest enterprise deals are well above the $100K implied ACV floor. The lack of transparent pricing creates uncertainty for buyers and analysts alike, and third-party pricing analysts note the "Contact Sales" model "likely targets larger enterprises" and has higher entry costs than some competitors. [CI012, CI013, CI014, CI015, CI016, CI033]

4.4 Cost Structure and Capital Efficiency

SecurityScorecard does not disclose gross margin, COGS, operating expenses, or EBITDA. Third-party headcount aggregators place the company in the 501–1,000 employee range, with LeadIQ reporting "501–1,000 employees" and the Forbes Council profile citing "over 600 employees." At $150M+ ARR and approximately 580–620 employees, the implied ARR per FTE is roughly $250,000–$260,000—consistent with efficient SaaS operators in the security space. The October 2025 press release disclosed two key financial efficiency signals: positive free cash flow for the quarter and a 40% improvement in ARR per full-time employee year-over-year. These signals, if accurate, imply that revenue is outpacing headcount growth and that the company is approaching or has crossed a cash-neutral operating model. The company also added three senior executives (CFO Chris Fritz, CRO Peter Jantzen, CMO Claire Trimble) in 2025, indicating continued investment in commercial leadership even during an efficiency drive. Gross margin for the core SaaS ratings platform is not disclosed. Industry benchmarks for comparable SaaS cybersecurity rating companies suggest gross margins in the 75–85% range due to the scalable, cloud-based delivery model with limited per-customer incremental cost. However, MAX managed services likely carries lower gross margins because it involves human-delivered remediation, partner cost-of-service components, and managed response workflows. As MAX grows faster than core subscriptions, the blended gross margin trajectory may face mild compression—a risk that cannot be quantified with available public data. [CI017, CI018, CI019, CI020, CI021, CI022]

4.5 Capital Adequacy and Funding Posture

SecurityScorecard has raised approximately $293M in equity across seven rounds from 2013 through its March 2021 Series E at a $1B post-money valuation. No new equity round has been publicly announced since March 2021—meaning the company has operated for more than five years on the Series E capital stack. The $1B valuation is therefore more than five years stale and reflects Series E market dynamics that differ substantially from current conditions. No debt facility, credit line, or secondary liquidity event has been publicly confirmed. The positive free cash flow signal from October 2025 suggests SecurityScorecard is not burning cash at a material rate, which is significant given the five-year absence of a new capital raise. This implies either (a) the company has reached or is near operating breakeven on a cash basis, (b) it has a material cash reserve from the Series E that continues to fund operations, or (c) some combination. Without a balance sheet disclosure, none of these hypotheses can be confirmed. The 40% ARR/FTE efficiency improvement reinforces the capital efficiency narrative, though the absolute cash position remains unknown. IPO readiness has been referenced in executive case studies, but no S-1 filing, bankers announcement, or explicit IPO timeline has been disclosed as of June 2026. At the implied $150M+ ARR run rate and a 7–10x ARR multiple typical for private SaaS cybersecurity companies in 2026, the enterprise value would be approximately $1.05–$1.5B, which roughly brackets the 2021 valuation. This suggests the stale valuation is neither dramatically cheap nor expensive relative to current ARR—but it is unverifiable without a current funding event. [CI023, CI024, CI025, CI038, CI043]

4.6 Financial Quality Assessment and Diligence Gaps

SecurityScorecard's observable financial profile is consistent with a growing, increasingly capital-efficient SaaS company: ARR exceeding $150M, positive free cash flow, 40% ARR/FTE improvement, triple-digit MAX growth, and 10+ consecutive quarters of revenue growth. These are meaningful signals for a private company in the TPRM market. However, nearly every metric required for full financial underwriting remains private or unverified. The adverse signal from the Safe Security CEO in June 2024—alleging that SecurityScorecard was "laying off significant portions of their teams because of the poor performance of their business"—was made during active litigation and represents a motivated competitor's characterization. The subsequent October 2025 press release reporting positive FCF and record quarterly performance directly contradicts this framing. However, the litigation context of the original $150M ARR disclosure (it appeared in the lawsuit settlement announcement rather than a standalone financial release) invites scrutiny and reduces its independent verifiability. The external-only security assessment methodology has also faced criticism for potential false positives and limited depth, which could impair pricing power and enterprise upsell capacity over time. Key diligence blockers include: gross margin by product line (core SaaS vs. MAX vs. TITAN AI), net revenue retention, trailing ARR growth rate from the $150M floor, exact headcount composition and productivity by function, cash and debt positions, and contribution margins from emerging revenue streams (insurance data, questionnaire automation). None of these are accessible from public sources as of June 2026. [CI026, CI027, CI028, CI029, CI030, CI034]

4.7 Exhibits

5.1 Outside-In Scoring Methodology and Data Engine

SecurityScorecard's foundational product is its outside-in security ratings engine — a non-intrusive, continuous assessment of an organization's internet-facing infrastructure that requires no agent installation or vendor cooperation. The engine categorizes every discovered security issue into one of ten risk factor groups: Network Security, DNS Health, Patching Cadence, Endpoint Security, IP Reputation, Application Security, Cubit Score, Hacker Chatter, Information Leak, and Social Engineering. Each issue type carries a High, Medium, or Low severity level, and those severity weights directly shape a 0-to-100 score for each factor as well as the overall numeric score, which maps to an A-through-F letter grade identical to a credit rating for cybersecurity. Scoring 3.0, launched on April 9, 2024 after a September 2023 preview period, replaced the prior methodology in which the overall score was simply a weighted average of the ten factor scores. Under 3.0, factors retain numeric scores but carry no individual weights in the overall computation; instead, the overall score directly reflects all discovered security issues and their severity impact. This change increased the breach-correlation signal: an F-grade organization (score ≤60) is now 13.8× more likely to sustain a breach than an A-grade (90–100) organization, compared to a 7.7× multiple under the prior model. SecurityScorecard's data science team assessed over 15,000 historical breaches to validate this correlation mapping. The scoring algorithm applies size normalization via a logarithmic scale to ensure fair comparison across organizations of very different sizes, preventing a small organization with few IPs from appearing artificially secure simply because it has fewer possible findings than a large enterprise. After calculating size-adjusted "z-scores" for each issue type, the algorithm applies a quarterly calibration pass to smooth statistical fluctuations. Daily recalibration of factor and total scores ensures low score volatility: if an organization's digital footprint and issue counts remain stable its score will remain unchanged from day to day.[CE001, CE002, CE003, CE004, CE005, CE006]

5.2 Product Module and Platform Ecosystem

SecurityScorecard's commercial offer has evolved from a standalone ratings product into a multi-module platform organized under the TITAN AI umbrella, announced at RSA Conference on March 23, 2026. TITAN AI comprises three tiers: TITAN Watch delivers always-on, continuous visibility into the vendor ecosystem — automatically discovering third- and fourth-party relationships and surfacing externally observable exposures in real time. TITAN Assess automates questionnaire management end-to-end, using AI agents to validate responses, prioritize risk, and conduct faster vendor assessments with a claimed 95% reduction in manual effort and a 9× improvement in vendor engagement rates. TITAN Secure adds threat-informed remediation, integrating real-time cyber threat intelligence (CTI) into triage workflows so that enterprises and suppliers can coordinate fixes the moment a critical exposure is identified. Alongside the self-service TITAN tiers, SecurityScorecard offers TITAN MAX — a managed service delivered through a certified partner franchise model that the company launched in January 2024. MAX operates a Vendor Risk Operations Center (VROC) staffed by practitioners in risk management, threat hunting, and incident response. It uses a NIST-aligned methodology and promises 26× faster questionnaire reviews, 2× higher issue remediation rates, and 75% fewer supply-chain breaches for enrolled organizations. MAX became available in the AWS Marketplace and was added to the CrowdStrike Marketplace in May 2025, expanding channel access without requiring direct SecurityScorecard sales engagement. The September 2025 acquisition of HyperComply added AI-powered questionnaire automation to the platform. HyperComply's proprietary RespondAI technology reduces manual questionnaire work by 92% and speeds questionnaire processing by 70%, building a centralized compliance knowledge base that stores validated answers for reuse. Integration of HyperComply features began in late 2025 with the goal of delivering continuous, automated supplier assurance for GDPR, DORA, and NIS2 compliance.[CE010, CE011, CE012, CE013, CE014, CE015]

5.3 Technology Architecture and Data Infrastructure

SecurityScorecard's data pipeline begins with a proprietary in-house global internet scanning framework that covers the entire IPv4 address space — more than 3.9 billion routable IPs — on a 10-day cycle across more than 1,400 ports. Cloud assets, which change ownership more rapidly, are scanned multiple times daily. The scanner collects IP address exposure data, fingerprints of services, products, operating systems, and libraries including version numbers, Common Platform Enumeration (CPE) IDs, CVE Version 2 IDs, and Nmap script output. This raw signal is supplemented by a network of sensors spanning three continents, plus a sinkhole and honeypot network that the company describes as one of the world's largest — capturing more than 2 billion malware DNS requests daily. Commercial and open-source threat intelligence feeds round out the signal ingestion layer. Attribution is the most operationally critical and error-prone step: SecurityScorecard must associate collected signals with specific organizations based on their digital footprints. The attribution engine relies on DNS lookups, BGP routing data, and other reliable mapping sources. Organizations can actively participate by claiming and refuting assets in their scorecard to improve attribution accuracy. The Scoring 3.0 engine applies a modified z-score calculation per issue type, comparing each organization against a reference population of more than 12 million rated entities and using the logarithmic normalization described above. SecurityScorecard applies machine-learning algorithms to improve accuracy of findings and provide insights on emerging threats such as ransomware strains and zero-day vulnerabilities. AI capabilities are embedded across the platform through the TITAN AI engine and the HyperComply RespondAI integration. The TITAN AI platform is presented as an "operational clearinghouse" that connects enterprises and vendors through a shared data layer — merging outside-in adversary telemetry from the rating engine with inside-out risk information from assessments to produce predictive, high-fidelity signals. The company asserts 99.9% accurate risk attribution with near-zero refute rate, though this claim is not independently audited.[CE019, CE020, CE021, CE022, CE023, CE024]

5.4 Integration Ecosystem, API Platform, and Developer Surface

SecurityScorecard provides a RESTful API at securityscorecard.readme.io with token-based authentication, supporting six primary integration patterns: enterprise cyber risk management, third-party risk management, workflow management, cyber insurance underwriting, compliance tracking, and attack surface management. API calls accept a domain plus an API token and return scorecard grades, factor scores, issue lists, historical findings, events, compliance mappings, and third-party supply chain data. Code samples are available in Shell, Ruby, Python, PHP, and other languages. API keys do not expire and must be stored securely in application secrets rather than in client-side code. The Integrate360° Marketplace hosts over 100 certified partner integrations including CrowdStrike Falcon, ServiceNow, Archer, OneTrust, and ProcessUnity, enabling customers to route SecurityScorecard data into existing GRC, ticketing, and SIEM workflows without custom engineering. MAX became available for direct purchase in the CrowdStrike Marketplace in May 2025, letting CrowdStrike Falcon customers add continuous supply chain risk monitoring to their security operations. The Microsoft 365 Copilot connector gallery lists a SecurityScorecard connector, and the platform integrates into AWS environments through its AWS Marketplace listing and cloud asset scanning capabilities. SecurityScorecard's GitHub organization (github.com/securityscorecard) hosts 63 public repositories, including the design-system React component library (TypeScript, Apache-2.0 license, 13 stars), SSC-Threat-Intel-IoCs (public IoC data tied to technical blog posts, 75 stars), an aws-big-data-blog Java project (623 stars), and infrastructure tooling including grpc-python-microservice-template and consul-template. A separate SSCDeveloperCommunity organization hosts hackathon and community integration projects. Developer activity indicates an active engineering organization but the public repositories are primarily internal tooling and sample code rather than externally-maintained open-source projects.[CE025, CE026, CE027, CE028, CE029, CE030]

5.5 Compliance Posture, Government Certifications, and Trust Controls

SecurityScorecard has built a meaningful government and regulated-sector compliance posture. In October 2023, the company achieved the FedRAMP Ready designation for its Third-Party Cyber Risk Management Platform including Attack Surface Intelligence, placing it among fewer than 450 cloud-based products with FedRAMP designation. In February 2025, the company reaffirmed FedRAMP Ready status and additionally achieved StateRAMP Ready designation, broadening eligibility to state and local government agency procurement. Both designations indicate compliance testing has been completed against rigorous federal security controls, but the company has not yet received a full FedRAMP Authorization to Operate (ATO), which would require sponsorship and review by a specific federal agency. SecurityScorecard's Attack Surface Intelligence product is separately approved on the Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM) Program Approved Products List (APL), enabling federal agencies to leverage the product directly. CISA incorporated SecurityScorecard into its catalog of Free Cybersecurity Services and Tools in 2022, and SecurityScorecard participates in the CISA Joint Cyber Defense Collaborative (JCDC) to share threat intelligence for the defense of public and private critical infrastructure. The company has an active partnership with the Transportation Security Administration (TSA) Surface Operations Cybersecurity Assurance Division to monitor critical infrastructure partners, which the White House described as a "game-changing" blueprint for sector risk management agencies. On data quality and trust, SecurityScorecard publishes a dispute resolution process that is accessible to customers and non-customers alike. Disputed findings are marked as such until resolved, with a promised response within 24 hours and score adjustments finalized within 72 hours for validated disputes. The company claims a false positive rate below 1%, achieved through rigorous internal validation, asset claiming/refutation tools, and partnerships for data corroboration.[CE031, CE032, CE033, CE034, CE035, CE036]

5.6 Methodology Limitations, Criticism, and Product Risks

SecurityScorecard's scoring uses a proprietary algorithm whose detailed component-level evidence and factor-interaction logic are not publicly published, limiting independent audit and reproducibility. Organizations subject to scores often cannot trace exactly which data points or signal combinations caused a specific finding, frustrating CISOs who wish to verify accuracy before actioning the result. Forrester's 2024 cybersecurity risk ratings Wave noted specific platform gaps: SecurityScorecard lacked AI-parsing tools to assess uploaded evidence documents (SOC 2 reports, policy PDFs), and the platform had challenges preventing duplicate findings when the same asset is reported under both an IP address and a hostname. Bitsight surpassed SecurityScorecard on Forrester's strategy score in the 2024 Wave, though SecurityScorecard retained the top position for current offering strength. The outside-in scanning model has structural limitations that are unresolvable without agent deployment. A verified AWS Marketplace customer noted that SecurityScorecard only monitors public-facing internet assets, not internal (non-internet-facing) devices, which means internal network risks — lateral movement vectors, non-routable host vulnerabilities, endpoint compliance — fall outside the product's coverage model. Attribution errors also persist: organizations are occasionally scored against IP addresses, domains, or assets they do not own, which can lower their grade unfairly. While the dispute mechanism exists, the resolution process can require weeks for complex disputes, during which the incorrect score affects third-party decisions made by customers, insurers, and regulators. AI capability claims associated with TITAN AI — including the 99.9% accurate risk attribution, 75% breach reduction, and 9× vendor engagement improvement — are company-asserted figures without independent validation. The HyperComply integration began in late 2025 and is still completing platform unification; the combined product track record is limited. FedRAMP Ready status (but not Authorized) may slow government agency adoption pending full ATO sponsorship. These gaps collectively create material diligence questions around scoring transparency, AI evidence quality, and government market timing.[CE038, CE039, CE040, CE041, CE042]

5.7 Exhibits

6.1 Customer Base Segmentation and Ideal Customer Profile

SecurityScorecard's paying customer base numbered over 3,300 organizations as of February 2026, a jump from approximately 2,600 customers in early 2024 — representing roughly 27% growth in two years. The platform's stated ideal customer profile is the enterprise CISO or TPRM manager in a regulated sector who must continuously monitor a complex vendor ecosystem without dedicating large internal teams to manual assessments. Buyer, user, and payer roles are largely unified in mid-market and enterprise accounts: the CISO or VP of Security typically champions the purchase, procurement or risk leadership approves the budget, and TPRM analysts operate the platform daily. In cyber insurance contexts, an additional payer emerges — underwriters at carriers like Aon use SecurityScorecard scores as part of their CyQu cyber risk platform, making insurance buyers an indirect customer segment that drives demand from rated organizations seeking favorable underwriting terms. Vertical concentration skews toward financial services (accounting for 12% of all PeerSpot research sessions), followed by technology, healthcare, government, and private equity. Large enterprises (more than 1,000 employees) constitute 53% of PeerSpot researchers evaluating SecurityScorecard, underscoring that the platform is anchored in the enterprise rather than the SMB market. The $400/month starter tier, added in late 2024, attempts to address SMB accessibility, but the $15,000/year entry-level paid tier and enterprise packages exceeding $100,000/year position the product firmly at mid-to-large organizations with dedicated security budgets. Geographically, the customer base is concentrated in North America, with meaningful Japan traction through Macnica's distributor network and growing APAC, European, and Middle East footprints delivered via MAX Service Delivery Partners including KPMG Canada, Crowe LLP, Uniqus Consultech, and P3 Group. The National Defense ISAC (ND-ISAC) offers SecurityScorecard enterprise licenses to its defense-sector member organizations, confirming penetration into the U.S. national security supply chain.[CU001, CU002, CU003, CU004, CU005, CU006]

6.2 Adoption Trajectory and Market Penetration

SecurityScorecard's commercial trajectory reflects a company that has moved from a niche security ratings provider into a multi-product platform with compounding growth across both direct and partner channels. Revenue grew from $88.5M in 2022 to $144.3M in early 2024 (approximately 36% year-over-year), with customer count expanding to 2,600 by early 2024 and passing 3,300 by February 2026. The MAX managed service, launched in January 2024, emerged as the fastest-growing product, with triple-digit year-over-year growth reported through mid-2025. Channel ARR from the SCORE Partner Program grew 160% YoY in 2025, and partner-led pipeline increased 126% YoY — evidence that indirect sales are now a primary growth mechanism alongside direct enterprise sales. Beyond paying customers, the platform's "monitored universe" of 12 million continuously rated entities and the free-tier product (allowing any organization to view its own scorecard at no cost) create a large top-of-funnel awareness surface. FeaturedCustomers cataloged 56 testimonials, 55 case studies, and a Winter 2026 Market Leader designation with a 4.8/5 composite rating from 3,007 references — evidence of broad and deepening customer engagement across industries. The platform also acquired FedRAMP Ready and StateRAMP Ready designations in February 2025, unlocking formal eligibility for U.S. federal and state government procurement, a high-value segment with long contract durations and strong retention characteristics. From 2021 to 2026, the monitored entity count grew from approximately 11.68 million (October 2021) to over 12 million, suggesting that new customer intake is driving modest but steady expansion of the monitored universe.[CU010, CU011, CU012, CU013, CU014, CU015]

6.3 Named Customer Proof and Production Deployment Quality

SecurityScorecard's publicly available named customer library includes production-grade deployments across five distinct customer archetypes: international public-sector institution, global consumer brand, European private equity, media agency, and cyber insurance integrator. The United Nations International Computing Centre (UNICC) provides the highest-quality evidence: a four-page case study with named senior administrator Alejandro Bustos, documented deployment across 80+ UN agencies, a specific DNS-incident use case resolved via automated alerting, and a 70-75% time savings figure on cybersecurity operations. The Hershey Company case study features Phil Addison (Manager of Third-Party Cyber Risk Management) confirming 100% cyber visibility across the full third-party landscape — including vendors not assessed via questionnaire — and integration into incident response, vulnerability management, and M&A due diligence workflows. Both cases verify production status rather than pilot deployments. Verdane, the European growth-equity firm, demonstrates the private-equity use case: SecurityScorecard provides portfolio-wide cyber due diligence across 100+ companies without deploying external consultants, enabling a lean in-house cybersecurity capability. Horizon Media achieved an "A" security rating and uses SecurityScorecard as an external trust signal in client-facing sales conversations — a documented use case where the platform functions as a customer acquisition tool for the rated organization. The Aon integration represents institutional proof at the insurance-sector level: Aon embedded SecurityScorecard's outside-in capabilities into its CyQu underwriting platform, making SecurityScorecard data a standard input in Aon clients' cyber insurance processes across more than 120 countries. Reference quality across these cases is strong: all are named, most include specific operational metrics, and all confirm production deployment. However, the customer library covers a relatively narrow set of verticals — healthcare, retail, and government agencies outside the UN system are underrepresented among public case studies, creating an evidence gap for those segments.[CU016, CU017, CU018, CU019, CU020, CU021]

6.4 Retention Signals, Satisfaction Ratings, and Workflow Depth

SecurityScorecard does not publicly disclose net revenue retention, gross revenue retention, or cohort-level churn data — a significant gap for underwriting any recurring-revenue valuation. Proxy signals from public review platforms, however, paint a consistently positive picture. Gartner Peer Insights rates the platform 4.4/5 from 278 reviews, with 62% five-star ratings, Service and Support at 4.7/5, and Evaluation and Contracting at 4.6/5 — scores that place SecurityScorecard in the upper tier of Gartner's Third-Party Risk Management market reviews. SoftwareReviews reports 100% plan-to-renew intent and 92% likeliness to recommend from 18 verified users. TrustRadius rates the product 9/10 from seven verified reviews. These signals collectively suggest high gross retention among active enterprise customers, though they cannot substitute for formal NRR disclosure. Workflow depth is a key retention driver: the Hershey Company case study reveals a single-person TPRM operation using SecurityScorecard to achieve 100% vendor landscape coverage while also integrating with incident response, SOC triage, vulnerability management, exposure management, and M&A due diligence pipelines. This multi-workflow embedding creates switching costs that insulate renewals. UNICC reported 70-75% time savings in cybersecurity operations. PeerSpot users highlight continuous monitoring, automated alerting, breach notification integration, and IP reputation scanning as the features generating the highest return. The platform's 92% reduction in manual questionnaire workloads (company-stated for TITAN AI) and its integration into CrowdStrike, AWS, BlinkOps, and 90+ ecosystem partners further deepen workflow lock-in for customers who build adjacent security operations around SecurityScorecard data.[CU022, CU023, CU024, CU025, CU026, CU027]

6.5 Partner Ecosystem, Expansion Drivers, and Concentration Risk

SecurityScorecard's land-and-expand motion operates through two reinforcing mechanisms. The first is product upsell: a customer who starts with self-monitoring (free tier or basic paid) can progressively add vendor monitoring portfolios, questionnaire automation (TITAN Assess), threat-informed TPRM (TITAN Secure), and ultimately migrate to MAX managed services — each transition represents a meaningful ARR increase. The second is channel leverage: the SCORE Partner Program and MAX Service Delivery framework allow MSSPs, consulting firms (KPMG Canada, Crowe LLP), and technology integrators to bundle SecurityScorecard within managed security offerings, pulling new enterprise logos into the base without direct SecurityScorecard sales capacity. The 600+ global partners and 160% channel ARR growth in 2025 confirm that indirect sales is now the faster-growing vector. Insurance sector integration with Aon represents a unique structural expansion driver: Aon clients who use CyQu receive SecurityScorecard data as a baseline assessment — creating an indirect pipeline of organizations that encounter the product before becoming direct customers. Similarly, SecurityScorecard's listing as a CISA free tool drives awareness and trial among U.S. government and critical infrastructure operators who may convert to paid enterprise subscriptions. Macnica's Japan distribution partnership demonstrates geographic concentration risk mitigation: a single high-performing in-country distributor that won Partner of the Year Japan for 2025 now owns the primary go-to-market in a market with complex enterprise procurement requirements. Concentration risk is present but not acute at the customer level: no single named customer dominates disclosed revenue. Channel concentration risk is more material — if the MAX partner ecosystem or the Aon integration were disrupted, the primary growth vectors could be significantly impaired. The rapid acceleration of channel ARR also means that direct enterprise retention data becomes increasingly hard to observe as more revenue runs through partner relationships.[CU029, CU030, CU031, CU032, CU034, CU035]

6.6 Adverse Evidence and Adoption Friction

Independent review platforms and direct competitors surface four categories of adoption friction that constrain SecurityScorecard's expansion and retention potential. The first is methodology opacity: Black Kite, a direct competitor, characterizes SecurityScorecard's scoring as having "moderate" transparency with "black box" elements — limited visibility into underlying data sources and calculation logic compared to Black Kite's standards-aligned open methodology. In the April 2026 Forrester Wave for Cybersecurity Risk Ratings Platforms, SecurityScorecard received a score of 1 out of 5 on AI capabilities and customer AI adoption — a below-par result relative to peers like Black Kite (which scored 5/5 in the same category). This Forrester finding is particularly significant given that SecurityScorecard launched TITAN AI in March 2026, suggesting the platform's AI capabilities were not yet mature enough at evaluation time to earn top-tier marks. The second friction point is false-positive attribution: both G2 and AuditXYZ reviewers cite instances where SecurityScorecard incorrectly attributes vulnerabilities to an organization after a corporate acquisition — the acquiring company's score can be dragged down by subsidiaries' issues that are not yet operationally integrated. Resolving these disputes requires the rated organization to submit counter-evidence, which shifts the burden of proof onto the customer. The third is pricing friction: PeerSpot reviewers note that the $1,000/month mid-tier pricing is unaffordable for smaller organizations, and even the recently introduced $400/month starter tier has limitations. Some South American and European customers face additional tax and wire-transfer surcharges that effectively raise the cost. The fourth is service-quality regression: Capterra reviewers note that after organizational changes, some long-term customers experienced reduced personalization and slower support responsiveness. These issues represent real friction in renewal conversations, especially for customers without dedicated enterprise success managers.[CU036, CU037, CU038, CU039, CU040, CU041]

6.7 Exhibits

7.1 Methodology Opacity, False Positives, and Outside-In Limits

SecurityScorecard's core competitive asset—its outside-in ratings engine—is simultaneously its greatest structural liability. Because the platform relies exclusively on externally observable signals (open ports, DNS health, IP reputation, certificate anomalies, and dark-web exposure), it cannot assess any compensating control that is not internet-visible: compensating firewalls, network segmentation, application-layer protections, and internal governance postures are fully invisible to the model. This creates a well-documented class of false positives where legitimate configurations—such as cloud-provider shared IP ranges, ephemeral development environments, and correctly managed but externally unusual TLS settings—are scored as vulnerabilities, causing vendor friction and dispute escalation. Independent user research captured in PeerSpot and AuditXYZ reviews (updated June 2026) documents that false positives remain a top complaint among practitioners: "Pricing requires improvement, particularly in Brazil, and overall pricing expectations could be lower considering the SaaS model" co-exists alongside complaints that "inaccuracies arise from associating unrelated company vulnerabilities" and that remediation guidance lacks specificity about root-cause versus noise. Industry-wide analysis from Netcraft (2024) found that 33% of companies delayed responding to actual cyberattacks because teams were investigating false alarms, illustrating the systemic cost of high false-positive rates in automated scoring tools. SecurityScorecard's 10-day IPv4 scan cycle—versus UpGuard's 24-hour cycle—adds a temporal gap during which newly emerged vulnerabilities may persist undetected, a factual differentiator that competitors use in sales conversations. The "outside-in only" design also creates an asymmetric contestation market: scored companies with low grades have strong commercial incentives to dispute findings, and if disputes gain regulatory traction or become legally actionable, SecurityScorecard's core product monetisation model faces existential challenge. Score transparency and score change explanations were identified as recurring weaknesses in peer reviews, further undermining buyer confidence in the methodology.[CR001, CR002, CR003, CR004, CR005, CR034]

7.2 Competitive Displacement and Platform Bundling Risks

SecurityScorecard competes in an increasingly crowded third-party risk management (TPRM) market where platform bundlers—ServiceNow, OneTrust, and Microsoft—are embedding native risk-rating and vendor risk workflow capabilities into existing GRC stacks already deployed at large enterprise accounts. For buyers who have standardised on these platforms, the incremental value of a standalone point solution is harder to justify, particularly at SecurityScorecard's reported pricing (starting ~$15,000–$16,500/year for basic tiers; enterprise portfolios exceeding $100,000/year). A meaningful erosion risk comes from Moody's Corporation, which was a Series C investor in SecurityScorecard in 2017 but subsequently acquired BitSight—creating a structural conflict: a former strategic backer now funds and integrates a direct competitor into credit analytics, insurance underwriting, and regulatory workflows where Moody's brand carries embedded credibility. PeerSpot's June 2026 IT Vendor Risk Management comparison shows SecurityScorecard's mindshare fell to 5.7% (from 11.1% in the prior year), while BitSight's mindshare simultaneously declined to 5.8% (from 10.8%), suggesting both legacy leaders are losing share to emerging entrants and bundled platforms. UpGuard positions its faster 24-hour scan cycle and all-in-one TPRM bundle as a direct substitute, rated No. 1 by G2 in user sentiment. Forrester's recognition of BitSight as a Wave Leader in 2026—while SecurityScorecard was not identified as a Forrester Leader—creates a perception gap that enterprise procurement teams use in competitive evaluations. ServiceNow and OneTrust increasingly serve as the orchestration layer for vendor risk data, choosing which ratings engines to embed as plugins rather than treating them as strategic partners, which compresses SecurityScorecard's pricing power and switching-cost moat over time.[CR006, CR007, CR008, CR009, CR010, CR038]

7.3 Product Execution Risk and TITAN AI Validation Gap

SecurityScorecard's TITAN AI launch at RSA Conference 2026 (March 23, 2026) introduced aggressive performance claims: 99.9% accurate risk attribution with a near-zero refute rate, up to 95% reduction in manual TPRM effort, 9x higher vendor engagement, and up to 75% fewer supply-chain breaches. These are company-issued marketing claims without a published independent audit, peer-reviewed methodology, or longitudinal outcome study. The absence of third-party validation is material because the claims form the primary justification for pricing premium and pipeline acceleration; if enterprise buyers subject them to formal evaluation, SecurityScorecard may be unable to substantiate the numbers in a competitive bake-off, exposing the company to both commercial and reputational risk. TITAN AI is organised into three tiers—TITAN Watch (continuous visibility), TITAN Assess (AI-driven questionnaire automation), and TITAN Secure (threat-informed remediation)—each of which represents a capability that competitors including Safe Security's autonomous TPRM platform and UpGuard's native assessment workflows also claim to provide. Post-settlement collaboration with Safe Security (announced October 2025) reduces short-term litigation cost but also validates Safe Security as a capable market participant, potentially accelerating its growth and creating a longer-term competitive threat at the AI layer. The LIFARS DFIR acquisition (February 2022) added 50+ employees and expanded the professional services capability; integration risks—cultural alignment, service consistency, and DFIR tooling harmonisation—persist but are not publicly reported as resolved. Acquisition integration quality remains an unconfirmed diligence item given the private-company disclosure profile.[CR011, CR012, CR013, CR014, CR015]

7.4 Legal, Governance, and Reputational Risks

SecurityScorecard's only active litigation identified through public records was the trade-secret lawsuit filed in 2024 against Safe Security (Safe Securities, Inc.) and Mary Polyakova in the U.S. District Court for the Southern District of New York (Case No. 1:24-cv-04240), alleging DTSA violations, breach of end-user agreements, and unfair competition. The parties settled in October 2025 and announced a collaborative research partnership, removing immediate litigation cost but establishing a legal precedent that customer list data and trade secrets carry high sensitivity for disputes involving departing employees. No GDPR regulatory sanctions, FTC enforcement actions, or SEC disclosure failures have been identified against SecurityScorecard through GDPR enforcement trackers and industry databases as of June 2026. The governance structure concentrates strategic, product, and reputational capital heavily in Dr. Aleksandr Yampolskiy, CEO and Co-Founder since 2013. Yampolskiy holds a PhD in Cryptography from Yale, has prior CISO experience at Gilt Groupe, and security leadership experience at Goldman Sachs and Oracle. His removal, incapacitation, or departure would likely impair enterprise sales relationships, partnership negotiations (e.g., Aon, CISA recognition), and product vision continuity. No publicly disclosed succession plan or formal CEO backup governance policy has been identified. The company's private-company disclosure profile—no SEC filings, no public board committee disclosures—means independent governance oversight cannot be verified externally. A minor reputational risk exists from informal LinkedIn endorsements: third parties have cited Yampolskiy's social media engagement as validation of "strategic partnership" with SecurityScorecard without a formal commercial agreement, creating potential misrepresentation exposure.[CR016, CR017, CR019, CR020, CR021, CR022]

7.5 Financial, Valuation, and Market Cycle Risks

SecurityScorecard's last confirmed primary fundraising was a $180M Series E in March 2021 at a $1B post-money valuation. No subsequent public financing round, announced IPO, or disclosed secondary transaction has followed in over five years. Secondary market data from Premier Alternatives (accessed June 2026) shows an implied valuation of approximately $359.5M—a ~64% discount from the 2021 primary-round price—suggesting material valuation compression in private markets consistent with the broader 2022-2026 re-rating of late-stage SaaS unicorns. The company exceeded $150M ARR as stated in public communications (cited in the October 2025 Safe Security settlement press release), but gross margin, operating cash flow, burn rate, and ARR growth rate remain undisclosed, creating a material information gap for any investor assessing the path to profitability or the justification for a re-rate back toward the $1B unicorn level. Revenue concentration risk exists at the product and channel levels: the company's revenue is disproportionately tied to cyber insurance underwriting use cases (via Aon, Willis, and carrier partnerships announced through 2026) and enterprise TPRM mandates that track cyber regulatory expansion. Munich Re's 2026 Cyber Insurance report notes that more than two-thirds of large organisations experienced at least one third-party cybersecurity incident in the prior 12 months—a tailwind—but also that cyber insurance market cycles can shift rapidly, and that reinsurance capacity constraints or catastrophic systemic events (e.g., a large cloud-provider outage triggering mass claims) could contract underwriting appetite, directly reducing demand for SecurityScorecard's insurance-linked ratings use cases. A five-year funding gap increases the probability of a forced exit event (IPO, acquisition, or down-round) within the next 12-24 months, and the secondary-market price already implies this scenario is priced in by some holders.[CR026, CR027, CR028, CR029, CR030, CR031]

7.6 Operational, Dependency, and Insurance Channel Risks

SecurityScorecard's own infrastructure presents a meta-systemic risk: because the platform continuously monitors over 12 million companies' external attack surfaces and holds sensitive third-party risk assessment data for more than 3,300 enterprise customers including 70%+ of the Fortune 100, a successful compromise of SecurityScorecard's own systems would constitute a first-order supply-chain incident with catastrophic reputational and regulatory consequences. SecurityScorecard's 2025 Global Third-Party Breach Report found that 35.5% of all 2024 breaches were third-party related and 41.4% of ransomware attacks start through third parties—precisely the threat vector SecurityScorecard is positioned to defend against. This creates a high-visibility target profile and an expectation of practitioner-grade internal security posture. The Aon partnership announced February 2026 concentrates insurance-channel revenue and referral flow through a single broker relationship; if Aon's risk appetite shifts, if Aon expands its own native risk-scoring capability, or if Aon partners with a competitor (BitSight/Moody's), SecurityScorecard's insurance channel revenue could contract sharply. Cloud infrastructure concentration on major hyperscalers (AWS/GCP) creates platform dependency risk—an outage at the cloud provider level could interrupt continuous monitoring for the entire customer base simultaneously. No confirmed WARN Act filings, mass layoff announcements, or public restructuring actions have been identified for SecurityScorecard in 2026, suggesting near-term operational stability; however, headcount is estimated at 600-640 (down from prior-year estimates), which may reflect quiet attrition rather than formal restructuring. Customer support quality is a noted operational risk: PeerSpot reviews document that response times need improvement especially for non-enterprise tier clients, creating churn risk in the mid-market segment.[CR018, CR024, CR032, CR035, CR036]

7.7 Exhibits

8.1 Financing History and Current Valuation Context

SecurityScorecard raised $180M in its Series E round in March 2021, achieving a post-money valuation of approximately $1B and elevating the company to unicorn status. Total equity raised across six rounds since 2013 stands at approximately $293M, backed by Silver Lake, Sequoia Capital, GV (Google Ventures), Evolution Equity Partners, Riverwood Capital, NGP Capital, and Intel Capital. No new primary equity round has been publicly announced since March 2021, making the $1B figure five years stale as of this report date. Secondary market platforms provide the only observable current pricing signal. Premier Alternatives (June 2026) places the market-implied valuation at $359.5M, with approximately 210M shares outstanding and a per-share price of approximately $1.66, representing a 13% 52-week decline. The Hiive platform also shows $1.66/share; Notice.co shows $2.20/share. These signals — taken together — imply a secondary market enterprise value of $360–$470M, a 53–64% discount to the $1B last-round price. Secondary market prices for private company shares typically carry a liquidity discount of 20–40% versus intrinsic value, and may reflect cap table complexity, preference overhang from multiple rounds of liquidation preferences, or concern about the timing and exit path. Nonetheless, the compressed secondary pricing is a materially adverse signal that cannot be dismissed. The company has not disclosed IPO plans, S-1 filing timelines, or strategic sale processes. The broader unicorn cohort faces a tighter-than-2021 exit window: the cybersecurity IPO market reopened only in September 2025 with Netskope's $7.3B debut at $707M ARR (10.3x), and while the Google/Wiz $32B acquisition at ~32–45x ARR provided a high-water mark for cloud-native security, that premium belongs to a differentiated, hyper-growth asset with $1B ARR, not a TPRM/ratings provider growing at 20% overall ARR CAGR. [CV001, CV002, CV003, CV004, CV005, CV006]

8.2 ARR Anchor and Disclosed Operating Metrics

SecurityScorecard's only publicly disclosed revenue figure is "$150M+ ARR" from its October 2025 record-quarter press release. Third-party revenue aggregator Latka estimates full-year 2024 ARR at $144.3M and projected 2026 ARR at approximately $153.4M. The ARR trajectory — from $71M in 2021 to $88.5M in 2022, $106M in 2023, and $150M+ in October 2025 — implies a four-year CAGR of approximately 21%. Channel ARR grew 160% year-over-year in 2025 (partner program), though this reflects expansion from a smaller base and does not necessarily indicate overall company ARR growth acceleration. The company reported positive free cash flow and a 40% improvement in ARR per full-time employee in the October 2025 quarter, suggesting meaningful efficiency gains. However, the key value-driver metrics that sophisticated buyers require — gross margin, net revenue retention (NRR), monthly burn rate, CAC payback period, and logo churn — remain entirely undisclosed. Without NRR, underwriting revenue quality is speculative: a 110%+ NRR implies a dollar-based retention engine that commands premium multiples, while a 90% NRR suggests material churn risk and compresses applicable multiples. Comparable SaaS cybersecurity leaders (Palo Alto platform customers: ~120% NRR; CrowdStrike: strong NRR; SentinelOne Q1 FY27: 77% non-GAAP gross margin, 4% non-GAAP operating margin) show that disclosure transparency is the baseline expectation at this ARR scale. SecurityScorecard's opacity at $150M+ ARR is itself an investment risk. The 2021 Series E valued SecurityScorecard at ~14x forward ARR ($71M trailing ARR at round time). The $1B stated valuation today implies approximately 6.7x ARR on $150M — a meaningful compression in the implied multiple over five years, even though the stated price has not changed. This compression partially reflects the market re-rating of SaaS multiples after the 2022 correction; at the 2021 peak, high-growth SaaS commanded 20–40x forward revenue multiples. The question for investors is whether the 6.7x ARR implied today is a bargain, a fair market price, or still too high given opacity and growth rate. [CV009, CV010, CV011, CV012, CV013, CV014]

8.3 Comparable Valuation Framework

Public cybersecurity companies trade at a sector median of 7.8x EV/NTM revenue as of June 2026, per Multiples.vc and Windsor Drake, with wide dispersion: CrowdStrike at ~27x (platform leader, $5.25B ARR, 24% growth), Palo Alto Networks at ~18x (platform/NGS ARR $8B), and Tenable at 3.3x (vulnerability management, $1B revenue, slower growth). TPRM and risk-ratings vendors as a category sit closer to the Tenable end of the spectrum due to narrower product scope and heavier services mix, but SecurityScorecard's pure-SaaS ratings engine and insurance network could justify a modest premium above point-solution vendors. Private cybersecurity SaaS commands a median of 15.2x ARR across all growth bands (Windsor Drake), but this masks extreme stratification: companies at 10–30% ARR growth trade at a 6.1x ARR median, those at 30–50% at 9.8x, and hyper-growers above 50% at 15.2x. SecurityScorecard's overall ARR CAGR of approximately 21% since 2021 places it in the 10–30% growth band, implying a median private market multiple of approximately 6x–8x ARR, or $900M–$1.2B enterprise value. The most directly comparable private transaction is Veeam's $1.725B acquisition of Securiti AI at approximately $150M ARR, implying ~11x ARR — an 11x-of-revenue deal for a six-year-old, AI-native data security platform. ServiceNow paid approximately 23x ARR for Armis at $340M ARR growing 50% year-over-year — a much higher-growth asset. BitSight's 2021 round at $2.4B values it at approximately 12x ARR (on $200M+ ARR). The $32B Wiz/Google deal at 32–45x ARR is a true outlier (cloud-native, $1B ARR, 40%+ projected 2026 growth) and should not anchor TPRM-vendor comparable analysis. Synthesizing public medians (7.8x), private growth-band benchmarks (6–10x for 10–30% growth), and transaction comps (Securiti AI 11x, BitSight 12x strategic), a defensible base-case valuation range for SecurityScorecard is $900M–$1.2B at $150M ARR, with a strategic acquirer premium potentially reaching $1.5–2.0B. The $1B stated valuation sits comfortably within this range, but is not obviously cheap. [CV016, CV017, CV018, CV019, CV020, CV021]

8.4 Bull, Base, and Bear Scenarios

The bull case rests on three conditions: TITAN AI delivers measurable ARR acceleration above 30% per year by 2027, the insurance-driven revenue stream becomes quantifiable and earns a separate strategic-asset premium, and a financial or strategic acquirer (insurance carrier, credit ratings firm, or large GRC/risk platform) pays a 10–15x ARR multiple for the combined TPRM-plus-insurance-analytics package. At 15x ARR on $175M projected ARR, the enterprise value would reach approximately $2.25B — a 125% return over the $1B 2021 anchor. This scenario depends on margin disclosure confirming 75%+ gross margins and 110%+ NRR. The base case assumes continued 15–20% total ARR growth, no strategic acquirer paying a premium, and a public cybersecurity IPO market in 2027–2028 where TPRM/risk-ratings vendors trade in the 6–8x ARR band. At 7x ARR on $165M (mid-2027 projected ARR), the enterprise value reaches approximately $1.15B, broadly consistent with the $1B last-round price and offering modest upside from current secondary market levels. The base case is not a strong buy signal given the lack of downside protection from disclosed metrics. The bear case is triggered by margin or NRR disclosure revealing a sub-70% gross margin (consistent with the managed-services-heavy MAX model) and sub-100% NRR (customer churn pressured by BitSight/UpGuard competition). In this scenario, a 3–5x ARR multiple applies, yielding $450–$750M enterprise value — below the $1B last-round price and representing a meaningful down round. The secondary market's $360M implied valuation may be pricing in an asymmetric tail of this scenario, potentially compounded by cap table overhang from liquidation preferences accumulated across six rounds. [CV025, CV026, CV027, CV028, CV029, CV030]

8.5 Investment Thesis, Anti-Thesis, and Kill Criteria

The investment thesis rests on SecurityScorecard's category leadership in a structurally growing market. TPRM is no longer optional: NIS2, DORA, the SEC cyber-disclosure rule, and supply-chain ransomware frequency have converted security ratings from a discretionary tool to a board-level mandate. SecurityScorecard's 12M+ rated organizations, Fortune 100 penetration (70%), and deep insurance-underwriting integrations (Aon, Willis, and others) constitute a data and relationship moat that is difficult for new entrants to replicate. The TITAN AI launch at RSA 2026 and the HyperComply acquisition address the questionnaire-automation gap and could expand the total contract value per account. The anti-thesis is equally documented. The TPRM field has 200+ competitors; the Forrester Wave Q2 2026 placed BitSight as a Leader while SecurityScorecard was not top-ranked, suggesting competitive erosion at the highest-value enterprise deals. The outside-in ratings methodology faces persistent false-positive criticism that undermines buyer confidence and creates churn risk. Revenue opacity prevents verification of margin quality, NRR, or whether growth is driven by expansion (high multiple deserving) versus new logos (lower multiple deserving). The $1B valuation is five years stale with no subsequent price discovery, while secondary markets have moved 50–64% lower, implying investors are pricing exit uncertainty. The thesis break is a confirmed NRR below 100%, a disclosed gross margin below 70%, or a new primary round priced below $900M (i.e., a down round against the $1B 2021 anchor). Any of these would structurally shift the recommendation from TRACK to AVOID. [CV031, CV032, CV033, CV034, CV035, CV036]

8.6 Exit Readiness and Final Diligence Asks

SecurityScorecard has no announced IPO plans as of June 2026, and the cybersecurity IPO bar is high: Netskope required $707M ARR with 33% growth and 118% NRR to command a $7.3B debut. At $150M ARR and with undisclosed NRR and profitability, SecurityScorecard is not yet public-market ready on disclosed metrics alone. An M&A exit is the more probable near-term liquidity path, with potential strategic buyers including a credit-risk data incumbent (Moody's, S&P, Verisk), a large GRC/risk platform vendor (ServiceNow, SAP), a managed-security services acquirer, or a private equity consolidation of the TPRM category. The most critical diligence priority is NRR, gross margin, and burn-rate disclosure, without which no premium multiple can be defended. Secondary priorities include cap table transparency (preference structure, anti-dilution provisions, weighted-average proceeds allocation) and the quantification of insurance-underwriting revenue as a distinct asset with its own strategic premium. Final diligence asks are structured in Table TV006. Absent satisfactory responses to the NRR and margin disclosures, the recommendation remains TRACK rather than BUY, and investors should not price in bull-case outcomes without primary evidence. [CV037, CV038, CV039, CV040]

8.7 Exhibits