An F on SecurityScorecard now means 13.8× breach odds, up from 7.7×
SecurityScorecard's own breach multiples by grade under its 2022 method and Scoring 3.0 (2024), what a grade can and cannot tell an Indian buyer, checked September 2026.
SecurityScorecard now says a company graded F is 13.8 times as likely to be breached as one graded A.2 In 2022, when TechBag first wrote about the product, the same company put the gap at 7.7 times.1 The internet did not get twice as dangerous for F-graded firms in two years. The method changed, and a buyer who uses these grades to triage suppliers should know what changed before quoting either number to a board.
01The multiple nearly doubled because the scoring changed
Under the 2022 method, every finding was grouped into one of ten factors, each factor got a score out of 100, and the total was a weighted average of the ten, with the factor weights tuned by machine learning. SecurityScorecard validated it on 100,000 organisations over three years, including 2,200 breaches.1 Scoring 3.0, published in February 2024, drops the factor weights altogether. The total is now built only from issue-type weights, set by how strongly each of more than 200 issue types correlated with breach across over 15,000 publicly disclosed breaches. The ten factors survive as labels on a scorecard, not as inputs to the grade.2
The same F grade went from 7.7× to 13.8× the breach likelihood of an A when the method changed
Relative breach likelihood by letter grade (A = 1), SecurityScorecard's 2022 method against Scoring 3.0 (2024)
- 2022 method
- Scoring 3.0 (2024)
Table view
| 2022 method | Scoring 3.0 (2024) | Change | |
|---|---|---|---|
| B | 2.6 | 2.9 | 12% |
| C | 4.3 | 5.4 | 26% |
| D | 6 | 9.2 | 53% |
| F | 7.7 | 13.8 | 79% |
Source: SecurityScorecard, How Does Scoring Work? (2022) and Scoring 3.0 infographic (February 2024) · as of 30 September 2026 · vendor's own validation; correlation, not causal
02What a grade can and cannot tell you
The steeper curve is a sharper sorting tool: a D under Scoring 3.0 carries a higher multiple, 9.2, than an F did under the old method.2 But both multiples are SecurityScorecard measuring itself on its own breach data, and neither has been replicated by an independent party that we could find. The rating also sees only what faces the internet: open ports, certificates, email-authentication records, leaked credentials, infected hosts calling home. It cannot see whether a supplier’s backups restore or whether its administrators use multi-factor authentication on internal systems.
03Buying it in India
Any organisation can claim a free scorecard for its own domain, with no limit on users; paid plans for monitoring suppliers are priced by the number of organisations monitored and quoted, not listed.3 Pricing is in US dollars; through a reseller it is invoiced in rupees with 18% GST added. For a regulated buyer the obligation is already dated. The RBI’s Master Direction on outsourcing of IT services (10 April 2023, in force 1 October 2023) requires banks and NBFCs to assess and monitor their IT service providers,4 and SEBI’s CSCRF, in force since 31 August 2025, does the same for regulated market entities.5 A rating is useful evidence of monitoring; the audit and inspection rights those rules require still have to be in the contract. The third-party risk piece sets ratings beside questionnaires and prices both.
Sources
- SecurityScorecard, How Does Scoring Work? (2022 method: ten weighted factors; 100,000 organisations, 2,200 breaches; F = 7.7× A; grade bands) — copyright 2022
- SecurityScorecard, Scoring 3.0 infographic (issue-type weights only; 200+ issue types; 15,000+ breaches; F = 13.8× A) — February 2024
- SecurityScorecard, pricing (free scorecard for your own domain, unlimited users; paid tiers priced by organisations monitored, quote-only) — undated page
- Reserve Bank of India, Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102) — 10 April 2023; in force 1 October 2023
- SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities — 20 August 2024; in force 31 August 2025
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
