4 of SecurityScorecard's 10 risk factors are fixed by configuration, not a purchase

01Four of the ten factors are fixed in configuration

SecurityScorecard defines each factor by what its scanners see from the outside. Network Security is open ports such as SMB and RDP, and insecure or misconfigured TLS certificates. DNS Health is open resolvers and the SPF, DKIM, DMARC and DNSSEC records. Cubit Score is critical configuration issues such as exposed administrative control panels. Application Security is vulnerabilities, misconfigurations and missing best practice on publicly visible web applications.¹ Every item on those four lists is a setting: a port that should be closed, a record that should be published, a login page that should not face the internet, a header the web server should send.

The remaining two, Hacker Chatter and Social Engineering, measure discussion of your company in underground forums and the corporate accounts and marketing lists that are publicly findable.¹ They are worth reading. They are not a shopping list. Since Scoring 3.0 in 2024, factors no longer carry weights of their own; the grade is built from more than 200 issue types weighted by how strongly each correlated with breach.² The factor is now the label on a finding, which is a further reason to fix findings rather than buy for factors.

Application Security is the one configuration factor that sits on the border. Most of its findings, such as a missing security header or a server announcing its version number, are one line in a web-server configuration. Finding them across every subdomain the business has forgotten about is harder, and that is where a scanner earns its licence: it finds; the configuration change fixes. The same is true of Cubit Score’s exposed admin panels, which often sit on a subdomain someone set up for a project and never retired.¹

02Where a product is the answer, the shelf is crowded

For the factors that do need software, the choice is wide. On 30 September 2026 TechBag’s six decision guides that map to the ten factors listed 125 products by SKU. Endpoint protection, which answers both Endpoint Security and IP Reputation, held 36 of them from 20 vendors.⁶ The RMM and patch guide held 20 from 12 vendors,⁵ and the identity guide that covers MFA held 18 from 10.⁷

A crowded shelf changes the buying question. For patching, the grade rewards cadence, how quickly updates land on the services the scanner can see, so the test in a proof of concept is reach: does the agent patch the internet-facing servers, including Linux, and the third-party applications on them, not only Windows laptops? For information leak, the fix is not detecting leaked passwords but making them worthless, which is MFA on every external login.

IP Reputation deserves its own warning. SecurityScorecard runs a network of sinkholes that capture malware calling home and maps the infected IP address back to an organisation.¹ Behind an office firewall, every laptop leaves through a small pool of shared public addresses, so the finding names the office, not the machine. Only endpoint telemetry can say which laptop made the call, and that is the real argument for an EDR agent with searchable history over a signature antivirus: when the rating flags a host, the agent is how you find it, clean it and show the finding closed. Ask any vendor on the shortlist to demonstrate exactly that, starting from a public IP address and a timestamp.

Endpoint Security works the same way from the other side. The scanner sees the browser and operating-system versions that devices reveal when they connect to the internet, and grades how exploitable they look.¹ An agent that keeps browsers current moves this factor faster than any detection feature, which is why patch reach and endpoint protection should be bought, or at least tested, together.

03DNS health is the cheapest grade point on the scorecard

The DNS Health factor checks for the records that stop someone sending email as your domain: SPF, DKIM and DMARC.¹ Publishing them is a change at your DNS host, and DMARC has been a published standard since March 2015.³ The order matters, because a DMARC policy set straight to reject will bounce legitimate mail from a payroll or marketing platform nobody remembered was sending on your behalf.

04The 2022 shopping list, four years on

The original post named 26 vendors across the ten factors. Sixteen have a TechBag intel hub as of 30 September 2026, with dated prices and the India facts. Comodo’s enterprise business now trades as Xcitium, renamed in 2022,⁸ and SolarWinds has been private under Turn/River Capital since 16 April 2025.⁹ Kaspersky has been barred from new sales in the United States since 20 July 2024¹⁰; it remains on sale in India, and TechBag’s endpoint guide lists it with a price.⁶

The ten without a hub are Automox, PDQ, Patch My PC, Miradore, IPM+, Sumo Logic, SecurityScorecard itself, AppSealing, OneSpan and Authentic8. Some of the 2022 mapping was also wrong on its own terms: Jira, an issue tracker, was filed under patching; Datadog, an observability platform, under IP reputation; and the Authentic8 entry carried Proofpoint’s product description word for word.