Cyber risk scoring
The See.Tech external risk score is a single number from 0 to 100 that summarises how exposed an organisation is to the public internet. A higher score is better: 100 represents no material external exposure found, and a low score indicates significant exposure.
The score exists so that a technical assessment can be discussed by people who will never read a CVSS vector, without discarding the detail underneath it.
The example above is illustrative, not a real customer result. It shows the shape of a typical first assessment: strong in some categories, weak in others, with an overall score that would be misleading without the breakdown beneath it.
What contributes
The overall score is a weighted view of category scores. Each category is scored independently, so a single weak area is visible rather than being averaged away.
| Category | What raises the score | What lowers it |
|---|---|---|
| Vulnerabilities | No known vulnerabilities on internet-facing software | Reachable services with known vulnerabilities, weighted by CVSS severity |
| Breached accounts | No credentials for the domain in breach corpora | Credentials exposed, weighted by how many and how recent |
| Dark web exposure | No references to the organisation on monitored sources | Company data or credentials appearing on leak sites and forums |
| Email security | SPF, DKIM and DMARC correctly configured and enforcing | Missing DKIM, permissive SPF, or DMARC set to none |
| SSL / TLS | Modern protocols, strong ciphers, valid certificates | Legacy TLS versions, weak ciphers, expired or expiring certificates |
| IP and domain reputation | Clean reputation across threat intelligence sources | Listed infrastructure, or lookalike domains registered against the brand |
Reading the score
For executives
The score answers "are we more or less exposed than last quarter?" in one number. Its value is comparability over time and against an anonymised peer cohort in the same industry and region, not the absolute figure.
For technical teams
The category breakdown shows where the score is being lost, and the findings under each category are ranked by severity. The lowest category is usually where remediation buys the most improvement.
How it moves
The score changes when the underlying exposure changes and a rescan observes it. Rescans can be scheduled weekly or monthly, and change detection flags material changes between them with a timestamp and severity.
What it is not
A high score means little material exposure was observable from outside. It says nothing about internal controls, endpoint security, insider risk or whether a vulnerability is genuinely exploitable in your configuration.
Questions
A cyber risk score summarises an organisation's security exposure as a single figure so that it can be tracked over time and communicated to people who do not read technical findings. The See.Tech external risk score runs from 0 to 100 and reflects exposure observable from the public internet.
Higher is better. A score of 100 means no material external exposure was found. A low score means significant exposure was observed across one or more categories.
It means the overall external position is reasonable but at least one category is materially weak. The overall figure is always read alongside the category breakdown, because a single critical category can sit beneath a comfortable-looking total.
It changes when a rescan observes a change in the underlying exposure. Rescans can be scheduled weekly or monthly, and environmental change detection flags material changes between scheduled scans with a timestamp and a severity.
Yes. Industry benchmarking compares the score against an anonymised peer cohort by industry and region, presented as a percentile band alongside your own figure.
No. It reflects what is observable from outside. Internal controls, endpoint security, insider risk and the real exploitability of a given finding are outside its scope, and it should be read as one input rather than a verdict.
Start here
A See.Tech assessment starts from a domain name. Nothing is installed, no credentials change hands, and the first findings come back in hours.
Let's talk about protecting your brand, your customers, and your reputation. Our team is ready to show you exactly how See.Tech can help, starting today.
