BitSight Technologies, Inc.

Among other things, traces are received of activities of an online user who is associated with an entity. By analysis of the traces a security state of the entity is inferred. Also, a map is generated between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets. At least part of the generating of the map is done automatically. A user can be engaged to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities.

Systems and methods are disclosed for training a model to predict a cybersecurity risk based on entity firmographics. A breach dataset comprising a number of breach indicator values for a number of entities is generated, wherein each respective breach indicator value is (i) mapped to a respective entity of the entities and (ii) an evaluation of at least one of the first security incidents being associated with the respective entity during a time period. A number of aggregated risk feature values for a plurality of geographic locations are determined based on a plurality of second security observations. The aggregated risk feature values are joined to the breach indicator values and firmographic parameter values to form a training dataset. A model is trained using the training dataset to generate a predictive risk assessment for an entity of the entities based on the firmographic parameter values associated with the entity.

Methods and supporting systems for discovering and attributing computational assets to respective entities includes receiving datasets comprising source record data for numerous of entities and including attributes such as point of contact data elements and normalizing the data elements to maintain a consistent format across the source record data. A filter is applied against the normalized source record data to identify data that are either (i) redundant or (ii) refer to a bulk control entity. A further curation step can be applied against the data as the data is stored as a bipartite graph, wherein a first set of nodes of the bipartite graph represents source records and a second set of nodes represents attributes of the source records.

Disclosed are computer-implemented methods for ranking importance of assets of an entity, in which the assets can include hosts and/or IP addresses associated with the entity. The exemplary methods can include receiving datasets from one or more sources indicating frequency of system access, system configuration, and/or application configuration. The methods can include determining one or more input data based on the datasets. The methods can include determining, for each host and/or IP address associated with the entity, an importance ranking based on the input data. In some examples, the importance ranking may be based on a weighting of two or more input data.

The disclosure relates to a method of selecting a cybersecurity action plan; sending one or more questions; receiving a response to each of the one or more questions; for each question mapped to at least one risk vector rating: determining a risk score based on a weighted combination of the at least one risk vector rating and at least one weight; determining an indication of whether the question is indicative of a cybersecurity risk; and if the risk score is less than or equal to the threshold, assigning a flag to the question to indicate the question is indicative of a cybersecurity risk; and displaying an assessment report configured to show an assessment of cybersecurity risk of the affiliate.

The disclosure relates to a method of selecting a cybersecurity action plan; sending one or more questions; receiving a response to each of the one or more questions; for each question mapped to at least one risk vector rating: determining a risk score based on a weighted combination of the at least one risk vector rating and at least one weight; determining an indication of whether the question is indicative of a cybersecurity risk; and if the risk score is less than or equal to the threshold, assigning a flag to the question to indicate the question is indicative of a cybersecurity risk; and displaying an assessment report configured to show an assessment of cybersecurity risk of the affiliate.

Disclosed are computer-implemented methods for ranking importance of assets of an entity, in which the assets can include hosts and/or IP addresses associated with the entity. The exemplary methods can include receiving datasets from one or more sources indicating frequency of system access, system configuration, and/or application configuration. The methods can include determining one or more input data based on the datasets. The methods can include determining, for each host and/or IP address associated with the entity, an importance ranking based on the input data. In some examples, the importance ranking may be based on a weighting of two or more input data.

A cybersecurity risk management method may include recommending, for each of a plurality of affiliates of an entity, a respective cybersecurity criticality tier selected from a set of cybersecurity criticality tiers; receiving user input adjusting and/or adopting the recommended cybersecurity criticality tier for each of the affiliates; assigning each of the affiliates to the respective adjusted or adopted cybersecurity criticality tier; obtaining respective security scores for the affiliates; and displaying a user interface component configured to show a visualization of a cybersecurity risk management plan of the entity with respect to the plurality of affiliates, wherein the risk management plan partitions the affiliates into a plurality of affiliate sets based on the security scores and the assigned cybersecurity criticality tiers of the affiliates and specifies, for each of the affiliate sets, an action to be taken by the entity with respect to the affiliates in the affiliate set.

A system for determining an entity's security rating may include a ratings engine and a security database. The security database may include a manifest and a distributed index containing security records. Each of the security records may have a key (e.g., a network identifier of a network asset) and a value (e.g., security information associated with the network asset identified by the key). The keyspace may be partitioned into multiple key ranges. The manifest may contain references to segments of the distributed index. Each segment may be associated with a key range and may index a group of security records having keys within the key range. The manifest and the segments may be stored in an object storage system. The ratings engine may determine the security rating of an entity based on security records of the entity's network assets, which may be retrieved from the database.

Systems and methods are disclosed for providing a cyber resilience rating. A method can include obtaining a plurality of entity indicators. The method can include determining a peer group of entities for the entity based on the entity indicators. The method can include obtaining a plurality of loss event records for the peer group. The method can include executing, based on the loss event records, a plurality of Monte Carlo simulations to generate loss simulation data. The method can include identifying, based on the loss simulation data, an expected probability value. The method can include providing a risk factor score indicative of a cyber security risk of the entity based on the identified expected probability value. The method can include providing a cyber resilience rating for the entity based on a combination of the risk factor score, a fortitude factor score, and a governance factor score.