How we calculate vendor risk
The score combines five security categories. Each category has a weight that determines its contribution to the overall score.
What we score
Five security categories
Where the evidence comes from
The scoring model uses public sources such as exposure scans, breach disclosures, and security documentation, so you can review a vendor before you send a questionnaire or schedule a call.
Score details
What contributes to the score
Each category contributes a percentage of the overall score. Within a category, the percentages below show each factor's assigned weight. These weights describe the directory's scoring model; they are not settings you can change here. When a category cannot be scored for a vendor it drops out and its weight is redistributed across the remaining categories.
External Exposure40%
What attackers can see
Company Posture30%
Structural readiness
Breach History15%
Time-decayed recency
Time since the most recent disclosed breach. Re-breach risk spikes in the first 90 days; vendors fully age out only after ~24 months of clean history.
Certificates10%
Verifiable attestations
Industry-aware coverage of expected attestations: SOC 2 / ISO 27001 + GDPR baseline, plus HIPAA, PCI DSS or FedRAMP overlays where relevant.
Supply Chain5%
Direct-dependency health
Count of direct software dependencies that themselves grade D or F. The category drops out (weight redistributed) for vendors with fewer than 3 scored dependencies.
Understand risk across your vendor inventory.
See how Shift connects vendor security information to your organization's access and integrations.