shouldiuse.io

Report

Should I Use SecurityScorecard?

securityscorecard.com·Analyzed 1 day ago··Based on 12 sources

Protect your supply chain and manage third-party cyber risk with continuous vendor monitoring and TPRM.

Depends

Depends

Buy if you're a mid-to-large org with dozens of vendors, compliance pressure, or a board that wants a risk score.

Enterprise third-party cyber-risk monitoring. Right for big vendor lists and audits; overkill for small teams.

Confidence: Medium

25,000+

Customers

vendor-claimed

4.3/5

Software Advice rating

listed 2026

2013

Founded

by security researchers

$180M Series E

Funding

~$140M ARR reported

Value for money2

Quote-only pricing; ratings methodology contested

Feature depth4

Ratings plus CVE intel, CRQ, managed service

Pros

  • Used by 25,000+ organizations for continuous vendor security monitoring¹
  • Broad suite: ratings, CVE detection, cyber risk quantification
  • MAX managed service handles supply chain threat detection and response
  • Available via AWS Marketplace for easier procurement11
  • Named a Leader in a cybersecurity risk ratings report

Cons

  • Some CISOs refuse to even discuss SecurityScorecard⁶
  • No public pricing; implementation and onboarding cost extra⁸
  • Ongoing practitioner debate over whether ratings tools add value⁵
  • Reddit users hunt for open-source alternatives, signaling cost pain⁷

Gotchas

  • mediumEnterprise quote-only pricing; expect implementation and onboarding fees on top of license⁸
  • mediumRatings methodology is polarizing; some security leaders reject such scores outright⁶
  • mediumScore-impacting findings take real effort to resolve on your end

Best for

  • Mid-to-large enterprises with long vendor lists
  • GRC and third-party risk teams
  • Regulated industries (healthcare case study exists)
  • Boards wanting a vendor risk score

Not for

  • Small businesses with under ~20 vendors
  • Teams wanting transparent, self-serve pricing
  • Security teams that reject ratings methodologies outright
  • Anyone seeking open-source or self-hosted TPRM

Companies that use it

  • Altair

Security

No known public vulnerabilities found in the sources reviewed.

What users say

Software Advice lists 4.3/5 and G2 reviews run positive, but practitioner sentiment on Reddit and LinkedIn is polarized.

Alternatives

Compare SecurityScorecard with each alternative.

Spreadsheet + annual vendor questionnaires

Plenty for small teams; costs nothing

Full analysis

Based on ~15 public sources; review snippets truncated, so no verbatim user quotes available. Pricing details not public in reviewed sources.

Sources

  1. SecurityScorecard homepagesecurityscorecard.com
    official
  2. G2 reviewsg2.com
    review
  3. Software Advice reviews (4.3/5)softwareadvice.com
    review
  4. Reddit: Are you using BitSight / SecurityScorecard?reddit.com
    review
  5. Reddit: BitSight is snake oil, right?reddit.com
    review
  6. LinkedIn: The Dilemma of Security Ratings for CISOslinkedin.com
    review
  7. Reddit: Open-source alternative of SecurityScorecard?reddit.com
    review
  8. Vendr pricing datavendr.com
    review
  9. Series E funding press releaseprnewswire.com
    news
  10. FounderPath growth analysis (~$140M ARR)founderpath.com
    news
  11. AWS Marketplace listingaws.amazon.com
    official
  12. Product security pagesecurityscorecard.com
    security

Rate this review

Anonymous. You can change your vote.

Loading votes…

Ask a follow-up

Ask if a use case fits. Answers stay inside this report and its sources.

    Comments

    One queue. No replies. Give a display name first. Limit: 7 comments per day.

    Save a name to write a comment.

    No comments yet.