--- title: "4 of SecurityScorecard's 10 risk factors are fixed by configuration, not a purchase" summary: "SecurityScorecard's ten risk factors sorted by what closes a finding, 125 products counted in TechBag's guides, and the 2022 vendor list re-checked, as of September 2026." url: https://www.thetechbag.com/blog/cybersecurity-risk-factors-solutions format: Analysis desk: "Security operations" published: 2025-01-16 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["SecurityScorecard","security ratings","DMARC","patch management","EDR","MFA","attack surface","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/cybersecurity-risk-factors-solutions.png --- # 4 of SecurityScorecard's 10 risk factors are fixed by configuration, not a purchase *SecurityScorecard's ten risk factors sorted by what closes a finding, 125 products counted in TechBag's guides, and the 2022 vendor list re-checked, as of September 2026.* Analysis · Security operations · By TechBag · Published 2025-01-16 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/cybersecurity-risk-factors-solutions The short version - Four of SecurityScorecard’s ten risk factors are closed by changing configuration you already own: open ports, DNS and email records, exposed admin panels and web-server settings. No purchase is needed.[1] - Four need a product, and the shelf is crowded: TechBag’s guides held 125 products against them on 30 September 2026, 36 of them in endpoint protection alone. The last two factors are signals to investigate, not things to buy. - Of the 26 vendors our 2022 post recommended, 16 have a TechBag intel hub today, two have been renamed or sold, and one is barred from new sales in the US while remaining on sale in India. In 2022 we published a list that matched each of SecurityScorecard’s ten risk factors to products TechBag sold, 26 vendors in all. It answered a real question, the one every IT head asks after seeing a C or a D on a supplier portal: what do I buy to move this grade? The honest answer is that, for nearly half the factors, nothing. This piece sorts the ten by what actually fixes them, counts the products that exist for the rest, and checks what happened to the 2022 list. ## Four of the ten factors are fixed in configuration SecurityScorecard defines each factor by what its scanners see from the outside. Network Security is open ports such as SMB and RDP, and insecure or misconfigured TLS certificates. DNS Health is open resolvers and the SPF, DKIM, DMARC and DNSSEC records. Cubit Score is critical configuration issues such as exposed administrative control panels. Application Security is vulnerabilities, misconfigurations and missing best practice on publicly visible web applications.[1] Every item on those four lists is a setting: a port that should be closed, a record that should be published, a login page that should not face the internet, a header the web server should send. **Figure: Four factors are settings you change; four need a product running on the estate** *SecurityScorecard's ten risk factors, sorted by what closes a finding, TechBag reading of the vendor's definitions* Fixed in configuration - Network Security: close SMB and RDP to the internet; replace weak certificates - DNS Health: publish SPF, DKIM and DMARC; shut open resolvers - Cubit Score: take admin panels off the public internet - Application Security: security headers and server settings, then scan Needs a product on the estate - Patching Cadence: a patch tool that reaches every server and laptop - Endpoint Security: current browsers and OS, enforced by an agent - IP Reputation: infected hosts calling home, found and cleaned by EDR - Information Leak: leaked passwords made useless by MFA Source: SecurityScorecard, How Does Scoring Work? (factor appendix); TechBag classification · as of 30 September 2026 The remaining two, Hacker Chatter and Social Engineering, measure discussion of your company in underground forums and the corporate accounts and marketing lists that are publicly findable.[1] They are worth reading. They are not a shopping list. Since Scoring 3.0 in 2024, factors no longer carry weights of their own; the grade is built from more than 200 issue types weighted by how strongly each correlated with breach.[2] The factor is now the label on a finding, which is a further reason to fix findings rather than buy for factors. Application Security is the one configuration factor that sits on the border. Most of its findings, such as a missing security header or a server announcing its version number, are one line in a web-server configuration. Finding them across every subdomain the business has forgotten about is harder, and that is where a scanner earns its licence: it finds; the configuration change fixes. The same is true of Cubit Score’s exposed admin panels, which often sit on a subdomain someone set up for a project and never retired.[1] Our view Our view: start every remediation plan with the configuration column. It costs engineer hours, not licences, and an exposed RDP port or a missing DMARC record is exactly the kind of finding a supplier’s security reviewer asks about first. ## Where a product is the answer, the shelf is crowded For the factors that do need software, the choice is wide. On 30 September 2026 TechBag’s six decision guides that map to the ten factors listed 125 products by SKU. Endpoint protection, which answers both Endpoint Security and IP Reputation, held 36 of them from 20 vendors.[6] The RMM and patch guide held 20 from 12 vendors,[5] and the identity guide that covers MFA held 18 from 10.[7] **Figure: Endpoint protection has the most products to choose from; network security, a configuration factor, has the fewest** *Products listed by SKU in each TechBag decision guide, mapped to the SecurityScorecard factor it answers, 30 September 2026* Endpoint protection Endpoint Security, IP Reputation 36 products Email security DNS Health, through DMARC 22 products RMM and patch Patching Cadence 20 products IAM, SSO and MFA Information Leak 18 products Vulnerability management Application Security, Cubit Score 16 products Firewall and network security Network Security 13 products | | Value (products) | | --- | --- | | Endpoint protection | 36 | | Email security | 22 | | RMM and patch | 20 | | IAM, SSO and MFA | 18 | | Vulnerability management | 16 | | Firewall and network security | 13 | Source: TechBag decision guides, counted from the PRODUCTS list in each guide's source at the last commit of 30 September 2026 · as of 30 September 2026 TechBag countTechBag count We counted the entries in each guide’s product list as committed on 30 September 2026 and mapped each guide to the factors whose findings its products find or close. A product appears once even when it answers two factors. Hacker Chatter has no guide: threat intelligence feeds are not in the TechBag catalogue. A crowded shelf changes the buying question. For patching, the grade rewards cadence, how quickly updates land on the services the scanner can see, so the test in a proof of concept is reach: does the agent patch the internet-facing servers, including Linux, and the third-party applications on them, not only Windows laptops? For information leak, the fix is not detecting leaked passwords but making them worthless, which is MFA on every external login. IP Reputation deserves its own warning. SecurityScorecard runs a network of sinkholes that capture malware calling home and maps the infected IP address back to an organisation.[1] Behind an office firewall, every laptop leaves through a small pool of shared public addresses, so the finding names the office, not the machine. Only endpoint telemetry can say which laptop made the call, and that is the real argument for an EDR agent with searchable history over a signature antivirus: when the rating flags a host, the agent is how you find it, clean it and show the finding closed. Ask any vendor on the shortlist to demonstrate exactly that, starting from a public IP address and a timestamp. Endpoint Security works the same way from the other side. The scanner sees the browser and operating-system versions that devices reveal when they connect to the internet, and grades how exploitable they look.[1] An agent that keeps browsers current moves this factor faster than any detection feature, which is why patch reach and endpoint protection should be bought, or at least tested, together. ## DNS health is the cheapest grade point on the scorecard The DNS Health factor checks for the records that stop someone sending email as your domain: SPF, DKIM and DMARC.[1] Publishing them is a change at your DNS host, and DMARC has been a published standard since March 2015.[3] The order matters, because a DMARC policy set straight to reject will bounce legitimate mail from a payroll or marketing platform nobody remembered was sending on your behalf. **Figure: Getting DMARC to enforcement is four record changes, done in order over weeks, not a product** *The sequence for publishing email authentication on a domain, per the DMARC specification* 1. 01SPFList every service allowed to send as the domain, including the payroll and marketing platforms. 2. 02DKIMTurn on signing at each sender and publish its public key in DNS. 3. 03DMARC p=nonePublish a monitoring policy with a report address and read the aggregate reports for a few weeks. 4. 04Quarantine, then rejectTighten the policy once every legitimate sender passes; spoofed mail then stops at the receiver. Source: RFC 7489, Domain-based Message Authentication, Reporting and Conformance (DMARC) · as of 30 September 2026 TechBag countTechBag count Of the 22 products in TechBag’s email security guide on 30 September 2026, four mention DMARC and two are dedicated DMARC products: Proofpoint Email Fraud Defense and Mimecast DMARC Analyzer.[4] They read the aggregate reports for you, which helps a domain with dozens of senders. A company with three senders can read the reports itself. ## The 2022 shopping list, four years on The original post named 26 vendors across the ten factors. Sixteen have a TechBag intel hub as of 30 September 2026, with dated prices and the India facts. Comodo’s enterprise business now trades as Xcitium, renamed in 2022,[8] and SolarWinds has been private under Turn/River Capital since 16 April 2025.[9] Kaspersky has been barred from new sales in the United States since 20 July 2024[10]; it remains on sale in India, and TechBag’s endpoint guide lists it with a price.[6] **Figure: Sixteen of the 26 vendors the 2022 post named now have a TechBag intel hub; three changed name, owner or market** *Share of the 26 vendors recommended in the July 2022 post, status on 30 September 2026* 61.5% With a TechBag intel hub 16 of 26 vendors 11.5% Renamed, sold or barred from new US sales 3 of 26: Comodo to Xcitium, SolarWinds to Turn/River, Kaspersky Source: TechBag estate at the last commit of 30 September 2026; Xcitium and SolarWinds hubs; US BIS · as of 30 September 2026 · The two groups overlap: Xcitium and SolarWinds have hubs The ten without a hub are Automox, PDQ, Patch My PC, Miradore, IPM+, Sumo Logic, SecurityScorecard itself, AppSealing, OneSpan and Authentic8. Some of the 2022 mapping was also wrong on its own terms: Jira, an issue tracker, was filed under patching; Datadog, an observability platform, under IP reputation; and the Authentic8 entry carried Proofpoint’s product description word for word. Our view Our view: a list that maps a rating factor to a vendor logo invites buying the logo. The better map is factor to finding to fix, and only then to a product, for the four factors that need one. That is the order this piece follows, and the order we would quote in. If you are buying this in India The configuration column costs nothing but time. SecurityScorecard gives any company a free scorecard for its own domain, so the before-and-after is free to measure. For the product column, prices are mostly in US dollars and reach an Indian buyer through a reseller in rupees with 18% GST. One worked example from the endpoint guide: ESET PROTECT Entry lists at $42.20 per device a year,[6] about ₹3,503 at ₹83 to the dollar, or ₹4,133 with GST. For 100 devices that is ₹3,50,260 before GST and ₹4,13,307 after. TechBag quotes the tier-matched rupee price. The regulations make two of these findings more than a grade. **CERT-In’s Directions of 28 April 2022** require reportable incidents to reach CERT-In within six hours and logs of ICT systems to be kept for 180 days within Indian jurisdiction.[11] The **DPDP Rules**, notified on 13 November 2025, bring the reasonable-security-safeguard and breach-intimation duties into force on 13 May 2027.[12] The 2023 Act sets penalties of up to ₹250 crore for failing to take reasonable security safeguards.[13] An open RDP port in front of a customer database is the kind of failure that clause describes. How we did this Figures as of 30 September 2026 Factor definitions are from the appendix of SecurityScorecard’s “How Does Scoring Work?” paper; the change to issue-type weights is from its Scoring 3.0 infographic of February 2024. The sort into configuration, product and signal is TechBag’s reading of those definitions, not the vendor’s. Product counts are the entries in each decision guide’s product list in the repository at the last commit of 30 September 2026; guides have grown since, and later counts are not used. The 26 vendors are every vendor the July 2022 post named; a vendor counts as having a hub if its hub directory existed at that commit, with Xcitium standing for Comodo. The INR arithmetic uses the guide’s fixed conversion of ₹83 to the dollar and is for scale, not a quote. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [SecurityScorecard, How Does Scoring Work? (appendix: the ten factors and what each measures)](https://securityscorecard.com/wp-content/uploads/2025/03/How-Does-Scoring-Work-0325.pdf) — copyright 2022 2. [SecurityScorecard, Scoring 3.0 infographic (factors no longer weighted; 200+ issue types)](https://securityscorecard.com/wp-content/uploads/2024/04/INFOGRAPHIC-Scoring-3.0-v2.pdf) — February 2024 3. [IETF, RFC 7489: Domain-based Message Authentication, Reporting and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc7489) — March 2015 4. [TechBag, Email security decision guide (22 products, 14 vendors; DMARC products)](https://www.thetechbag.com/browse/security/email-security) — as committed 30 September 2026 5. [TechBag, RMM and patch management decision guide (20 products, 12 vendors)](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) — as committed 30 September 2026 6. [TechBag, Endpoint protection decision guide (36 products, 20 vendors; ESET PROTECT Entry $42.20 per device a year; Kaspersky Next listed)](https://www.thetechbag.com/browse/security/endpoint-protection) — as committed 30 September 2026 7. [TechBag, IAM, SSO and MFA decision guide (18 products, 10 vendors)](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — as committed 30 September 2026 8. [TechBag, Xcitium hub (the rebranded Comodo Security Solutions, since 2022)](https://www.thetechbag.com/xcitium) — as committed 30 September 2026 9. [TechBag, SolarWinds hub (private under Turn/River Capital since 16 April 2025)](https://www.thetechbag.com/solarwinds) — as committed 30 September 2026 10. [US Bureau of Industry and Security, Kaspersky Lab, Inc. prohibition (new sales from 20 July 2024)](https://www.bis.gov/kaspersky) — 2024 11. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting; 180-day logs within Indian jurisdiction)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 12. [DPDP Rules 2025, commencement timeline (safeguard and breach-intimation duties from 13 May 2027)](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 13. [Digital Personal Data Protection Act, 2023, Schedule (penalties)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023 Related on TechBag: the companion note on [what a SecurityScorecard grade means](https://www.thetechbag.com/blog/security-scorecards-security-ratings-overview), and the [vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) for the scanners that find application and exposed-panel issues before a rating does. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Email security guide](https://www.thetechbag.com/browse/security/email-security) — the DMARC products and the gateways, with prices and residency - [RMM and patch management guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) — patch reach and per-device pricing for the Patching Cadence factor - [Endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) — the EDR agents that find the host behind an IP Reputation finding