Report:

The Forrester Wave™: Cybersecurity Risk Ratings Platforms, Q2 2024

Top Vendor Products for Cybersecurity Risk Ratings Platforms in 2024

• Bitsight
• Panorays
• SecurityScorecard

Cybersecurity Risk Ratings Platforms Vendor Product Comparisons 2024

• Bitsight - Leaders
  

  Pros:

  • Pioneered the CRR market with unmatched commitment to innovation with 58 patents and largest R&D investment
  • Leading security performance analytics module provides deep insights into control performance
  • Native cyber risk quantification tool that measures financial exposure based on cyber loss data
  • Leans heavily into ratings model validation and correlation studies to continuously test alignment with real-world incidents
  • Policy review board manages finding disputes and publishes case summaries publicly
  • Collaboration dashboard streamlines interactions and planning with third parties
  • Strong partner ecosystem, adoption, and community strategies centered on building trust

  Cons:

  • Pricing model is relatively complex
  • Base offering doesn't include peer benchmarks and fourth-party data functionality
  • Reference customers noted instances where Bitsight data shared through GRC integrations did not match platform data, requiring extra verification work


• Panorays - Leaders
  

  Pros:

  • Superior vision highlights supply chain complexity and deep technical functionality required to secure it from first- and third-party perspectives
  • Strong AI-led asset and vendor discovery with confidence scores and source details for enhanced transparency
  • AI Document Validation tool assesses supplier questionnaire responses to verify observed data supports responses
  • Variety of integration options spanning GRC, IT asset management, procurement, privacy, and analytics tools
  • Strong UX to accelerate assessment workflows
  • Forward-looking partner strategy highlights collaboration with expert industry groups for best-practice content
  • Reference customers gave highest satisfaction rating for overall business value

  Cons:

  • Most strategic focus is on par with market but less differentiated than peers
  • Doesn't publish own ratings performance metrics
  • Lacks native risk quantification tools
  • Reference customers desired more dynamic reporting capabilities


• SecurityScorecard - Leaders
  

  Pros:

  • Only vendor that publishes live metrics about response time, findings refute rate, and IP/domain misattribution rates
  • Excels in asset discovery, data source variety, and ratings correlation testing due to extensive in-house historical data
  • Robust scanning functionality and superior security analytics
  • Strong in-platform collaboration functionality and reporting tools to ease risk communication
  • Aggressive roadmap focusing on reimagining third-party cyber risk and ramping up AI-driven insights
  • Strong partner ecosystem bolsters user adoption and experience
  • Uniquely engages 17 industry information-sharing centers

  Cons:

  • Strategic shifts into ASM, threat intelligence, and incident response introduce company to new buyers who traditionally wouldn't consider CRR platforms
  • Lacks AI-parsing tools to automatically assess uploaded evidence documents
  • Reference customers noted challenges with preventing duplicate findings when scanned IP and hostname report same asset


• Black Kite - Strong Performers
  

  Pros:

  • Unique focus on standards-based ratings tackles industry's ratings integrity problem head-on
  • Customers unanimously satisfied with rating accuracy
  • Strong in third-party vendor discovery and security assessment questionnaires
  • AI document-parsing tool analyzes compliance artifacts to streamline assessments
  • Native FAIR-based risk quantification for third-party risk scenarios
  • Ransomware Susceptibility Index strengthens security analytics
  • Simple two-tier pricing model with unlimited users
  • Value-add standard license includes more functionality than most vendors' standard packages

  Cons:

  • Most strategic focus is just on par with the market despite strong innovation
  • Adoption strategy lacks dedicated education focus compared with others
  • Supporting services delivered via managed service providers rather than directly
  • Reference customers cited issues with slow page loading and performance


• BlueVoyant - Strong Performers
  

  Pros:

  • Excels in supporting services due to product expertise in MDR and digital risk protection plus expansive professional services
  • Platform excels in automated vendor discovery using AI to identify vendor relationships from multiple data sources
  • Terrain Explorer tool provides leading visualization and data query functionality to explore vendor and product concentration and nth-party relationships
  • Questionnaire management includes smart review tools to determine how well compliance evidence satisfies criteria
  • Positioning in MDR market affords unique advantage to reach security operators

  Cons:

  • Ratings methodology weaker as it lacks correlation testing for real-world incidents
  • Vision and roadmap on par with market rather than differentiated
  • Need to strengthen innovation and community strategies to gain market share
  • Questionnaire tools delivered via partnership rather than natively
  • Reference customers wished to see questionnaire tools fully integrated with Supply Chain Defense platform


• Recorded Future - Strong Performers
  

  Pros:

  • Innovation approach emphasizing comprehensive R&D investment strategy
  • Excels in data source variety due to Intelligence Graph collecting and analyzing threat data from more sources than most
  • Extensive integrations with GRC, TPRM, ASM, and analytics tools
  • On-par functionality in security performance analytics and standards-based alignment with AI insights to summarize information
  • Strong adoption and community strategies including RF University, Intelligence Kit, free tools, curated news, seed fund for startups, and global events
  • Highly flexible pricing models by tiers of parties monitored

  Cons:

  • Roadmap below par with many planned enhancements already on market today
  • Rating approaches weaker as vendor doesn't conduct ratings correlation testing and uses relatively simple criticality weights
  • Less rigorous dispute process
  • Lacks native support for security questionnaires, deferring to partners
  • Reference customers desired more unified modules to support research needs
  • Product relatively expensive when adding support services


• RiskRecon - Strong Performers
  

  Pros:

  • Leading report-builder module
  • Standards-based alignment organizes exposure data across framework controls enabling deep control effectiveness assessment
  • Flexibility to define own frameworks and analyze performance with ratings data
  • Incorporates financial loss estimates via Cyber Quant product
  • Superior community strategy building thought leadership with customer base and industry associations
  • Strong supporting services due to integrated cybersecurity product portfolio from Mastercard
  • Strong growth, global reach, and multi-industry expansion

  Cons:

  • Weaker innovation strategy results in reactive instead of proactive product development
  • Lacks long-term focus on disruptive functionality
  • Ratings trust and transparency approach below par with less effort in resources and outreach compared to others
  • Lacks native security questionnaire module, using partner solution instead
  • Reference customers cited challenges with understanding asset attribution


• Prevalent - Contenders
  

  Pros:

  • Strong in vendor discovery and mapping with support for fourth- and nth-party discovery
  • Excels in security questionnaire management due to workflow capability throughout platform
  • Stands out with supporting services for assessment and management
  • Inclusion of cyber and other types of risk data about vendors lends to on-par functionality for risk prioritization
  • Solid set of integrations that help make Prevalent single source for TPRM
  • On-par partner ecosystem and adoption strategy that helps users scale

  Cons:

  • Overall approach to asset discovery and ratings methodology too simplistic for most security teams
  • Lacks data source variety
  • No ratings model correlation testing to breach causes
  • Lacks ratings model transparency
  • Roadmap and innovation strategy not well aligned with CRR market's demand for more first-party security use cases
  • Declined to participate in full Forrester Wave evaluation process


• UpGuard - Contenders
  

  Pros:

  • Market leading adoption strategy providing comprehensive approach to uplevel customer maturity with educational and customer success initiatives
  • Asset discovery and attribution functionality on par with enterprise-focused vendors
  • Comparable third-party questionnaire management support, in-platform collaboration tools, and security performance analytics
  • Unique ability for customers to instantly rescan environments to validate issue resolution
  • Reference customers unanimously satisfied with ability to increase risk visibility
  • Support and speed to fix issues is amazing with very fast product development

  Cons:

  • Partner ecosystem and supporting services strategies below par, centering on individual customer requirements rather than industrywide needs
  • Vendor discovery and mapping functionality not as automated as others
  • Prioritizes risk findings primarily by criticality rather than asset value which is below par
  • Reference customers requested more advanced automation and risk assessment workflow improvements


• ISS Corporate Solutions - Challengers
  

  Pros:

  • Strength in ratings transparency - one of only vendors that doesn't share exposure signal data between customer and third parties
  • Reference customers praised ratings model's correlation approach
  • Asset discovery and attribution processes have strong quality control
  • On par with risk prioritization and remediation functionality
  • Simplified pricing model makes it easy for customers to scale supplier monitoring
  • Vision to enable companies to see themselves through same lens as investors and stakeholders

  Cons:

  • Strategically underperforms due to tactical focus
  • Lags in key areas like partnerships, community, and adoption support
  • Asset discovery relies on manual curation making it difficult to scale
  • Reference customers said discovery was limited
  • Lacks capabilities for in-platform collaboration, security questionnaire management, and partner integrations
  • Will need to boost innovation and roadmap commitments to become more competitive

Reference

• Forrester, The Forrester Wave™: Cybersecurity Risk Ratings Platforms, Q2 2024, 19-May-2024, ID RES180905

View Market Definition
View Vendor Movements