The Panorays Cyber Posture Rating is an absolute 0–100 score that reflects the security posture of a company’s public-facing digital footprint.
Panorays customers use this rating—alongside other inputs such as security questionnaires, business context, and risk indicators—to evaluate and manage the cyber risk of their third parties.
The rating provides an objective, continuously updated view of a company’s external attack surface and highlights security gaps that may require remediation.
Non-Intrusive External Assessment
Panorays performs a non-intrusive, external cyber posture assessment, allowing continuous monitoring without requiring consent from the assessed company.
Assessment data is collected from:
Public sources (e.g., asset reputation and threat intelligence feeds)
Light probes (similar to search engine indexing bots)
Panorays is a 100% SaaS-based platform and does not access internal company resources.
While no active exploitation is performed, some public intelligence sources (e.g., botnet activity feeds) may provide indirect insights into internal security issues—without being intrusive.
Panorays does not conduct penetration testing, brute-force attacks, or exploit execution.
What Panorays Evaluates
Using 100+ automated cyber criteriasecurity tests, Panorays analyzes a company’s discovered external assets, including (but not limited to):
Web servers
Mail servers
DNS
Cloud services
Endpoints
Employee exposure
The platform identifies exposed assets, misconfigurations, outdated technologies, and missing security best practices. Findings often include specific vulnerability context, such as:
Technology versions
CVE correlations
Bug bounty disclosures
Assessment Layers
CriteriaTests are grouped into three top-level assessment layers, providing a comprehensive view of a company’s external cyber posture.
✅ Network & IT
Evaluates infrastructure, exposed services, and operational security practices.
Includes:
Web, email, and DNS servers
Endpoints and externally exposed assets
TLS protocols and certificate trust
Asset reputation
Cloud services and exposed systems
Example findings:
Expired or untrusted TLS certificates
Missing Web Application Firewall (WAF) on critical assets
✅ Application
Assesses externally facing applications, domains, and technologies.
Includes:
Web applications and APIs
CMS platforms (e.g., WordPress)
Domain vulnerabilities and attack exposure
Unpatched servers or applications
Example findings:
Exposure of WordPress user data
Outdated or vulnerable application versions
✅ Human
Analyzes the human attack surface and organizational security maturity.
Includes:
Employee exposure and likelihood of social engineering
Public social media posture
Presence (or absence) of a dedicated security team
Security awareness indicators
Example findings:
Compromised employee credentials
Lack of security awareness or governance
No dedicated security function
Rating Methodology
Test-Based Scoring
Each assessment consists of 100+ Criteria run against discovered assets (servers, IP ranges, domains, employees, etc.).
Each Criterion produces:
Findings (security gaps)
An individual 0–100 Criterion rating
A weighted average of all Criteria ratings generates the final Cyber Posture Rating.
Example Tests:
Do mail servers have an SPF record?
Do web servers support deprecated SSL/TLS protocols?
Are assets associated with malicious activity?
Criterion Properties
Each Criterion includes:
What is tested
What was found
Explanation and remediation guidance
Severity (Info / Low / Medium / High / Critical)
Weight (impact on the rating)
❗“Info” Criteria do not affect the rating.
❗“Critical” Criteria may have an additional impact on the overall risk.
Criteria Rating Calculation
Each Criterion is scored independently:
100 – No findings detected
0 – All assets failed
1–99 – Partial findings
N/A – Criterion is not applicable
Rating logic varies by Criterion and may include:
Simple ratios
Statistical normalization
Company size and industry benchmarks
Criteria Weights
Criteria weights are determined using objective data, including:
Benchmarking against trusted companies (e.g., Google, Amazon, Microsoft)
Industry-wide rating distributions
Analysis of breached companies to identify predictive indicators
Criteria Development & Tuning
Criteria are based on:
Industry standards (e.g., OWASP, NIST)
Proprietary research and threat intelligence
New Criteria are initially deployed in hidden mode to collect large-scale data. Severity and weight are then tuned based on real-world adoption, effectiveness, and validation against trusted and breached companies.
Why the Panorays Cyber Posture Rating Matters?
The Panorays Cyber Posture Rating delivers:
Accuracy – Data-driven scoring validated against trusted and breached organizations
Transparency – Full visibility into Criteria, findings, and discovered assets
Consistency – The same methodology applied to all companies
Stability – A durable indicator of overall cyber posture, not isolated issues
Together, this enables organizations to objectively assess, compare, and manage third-party cyber risk at scale.
Understanding scores and key terms
Customers often ask about the difference between several scores and fields in Panorays. Here is a quick reference:
Cyber Posture Score vs. Risk Rating
The Cyber Posture Score (0–100) is an objective, external assessment of a company's public-facing digital footprint — based entirely on automated security tests, as described in this article. It is the same for all evaluators viewing the same company.
The Risk Rating is a relationship-level score that factors in additional context beyond the external posture — such as questionnaire results, business impact, and risk acceptance decisions made by your organization. Two evaluators can have different Risk Ratings for the same supplier.
Why does the score shown to a supplier differ from what evaluators see?
Suppliers viewing their own profile see the objective Cyber Posture Score based on external assessment. Evaluators viewing a supplier's page see the Risk Rating, which incorporates relationship context. These two values are intentionally different — they measure different things.
Approval Snapshot vs. Business Snapshot
An Approval Snapshot captures the supplier's scores and findings at the moment an approval decision was made. It provides a historical reference point for audit purposes.
A Business Snapshot captures the supplier's information as it stood at a specific business event or date, such as contract renewal. It is used for tracking changes over time in a business context.
Common questions about score changes and assessments
Why did my Cyber Posture Score change?
Panorays continuously monitors your company's external digital footprint. Scores change when:
New findings are detected (e.g., an expired certificate, a newly exposed asset).
Existing findings are resolved (e.g., a misconfiguration is fixed, a certificate is renewed).
Panorays updates or tunes an assessment Criterion's weight or severity based on new threat intelligence.
A score change is not always negative — remediating findings will improve your score over time.
My assessment appears to be stuck or incomplete
If your assessment has not updated for an unusually long period or shows an incomplete status, contact [email protected] with your company name and primary domain. The support team can review the status of your assessment.
Can I request a reassessment?
Contact [email protected] to request a manual review or reassessment of your company's profile.