--- title: "An F on SecurityScorecard now means 13.8× breach odds, up from 7.7×" summary: "SecurityScorecard's own breach multiples by grade under its 2022 method and Scoring 3.0 (2024), what a grade can and cannot tell an Indian buyer, checked September 2026." url: https://www.thetechbag.com/blog/security-scorecards-security-ratings-overview format: Note desk: "Security operations" published: 2025-01-14 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["SecurityScorecard","security ratings","third-party risk","vendor risk","Scoring 3.0","RBI","SEBI CSCRF"] cover: https://www.thetechbag.com/blog/covers/security-scorecards-security-ratings-overview.png --- # An F on SecurityScorecard now means 13.8× breach odds, up from 7.7× *SecurityScorecard's own breach multiples by grade under its 2022 method and Scoring 3.0 (2024), what a grade can and cannot tell an Indian buyer, checked September 2026.* Note · Security operations · By TechBag · Published 2025-01-14 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/security-scorecards-security-ratings-overview SecurityScorecard now says a company graded F is 13.8 times as likely to be breached as one graded A.[2] In 2022, when TechBag first wrote about the product, the same company put the gap at 7.7 times.[1] The internet did not get twice as dangerous for F-graded firms in two years. The method changed, and a buyer who uses these grades to triage suppliers should know what changed before quoting either number to a board. ## The multiple nearly doubled because the scoring changed Under the 2022 method, every finding was grouped into one of ten factors, each factor got a score out of 100, and the total was a weighted average of the ten, with the factor weights tuned by machine learning. SecurityScorecard validated it on 100,000 organisations over three years, including 2,200 breaches.[1] Scoring 3.0, published in February 2024, drops the factor weights altogether. The total is now built only from issue-type weights, set by how strongly each of more than 200 issue types correlated with breach across over 15,000 publicly disclosed breaches. The ten factors survive as labels on a scorecard, not as inputs to the grade.[2] **Figure: The same F grade went from 7.7× to 13.8× the breach likelihood of an A when the method changed** *Relative breach likelihood by letter grade (A = 1), SecurityScorecard's 2022 method against Scoring 3.0 (2024)* | | 2022 method | Scoring 3.0 (2024) | Change | | --- | --- | --- | --- | | B | 2.6 | 2.9 | 12% | | C | 4.3 | 5.4 | 26% | | D | 6 | 9.2 | 53% | | F | 7.7 | 13.8 | 79% | Source: SecurityScorecard, How Does Scoring Work? (2022) and Scoring 3.0 infographic (February 2024) · as of 30 September 2026 · vendor's own validation; correlation, not causal ReportedWhat the grades mean A is 90 or above, B 80 to 90, C 70 to 80, D 60 to 70, F below 60. Findings are scored against organisations of a similar digital footprint, so a bank with a million IP addresses is not marked down simply for being large. Fixing ten per cent of one kind of finding lifts the score by the same amount whether that is 20 of 200 findings or 200 of 2,000.[1] ## What a grade can and cannot tell you The steeper curve is a sharper sorting tool: a D under Scoring 3.0 carries a higher multiple, 9.2, than an F did under the old method.[2] But both multiples are SecurityScorecard measuring itself on its own breach data, and neither has been replicated by an independent party that we could find. The rating also sees only what faces the internet: open ports, certificates, email-authentication records, leaked credentials, infected hosts calling home. It cannot see whether a supplier’s backups restore or whether its administrators use multi-factor authentication on internal systems. Our view Our view: use the grade to decide which of your suppliers get a questionnaire and a call this quarter, and to notice when one of them drops a band. Do not file it as evidence that a supplier is secure. A D-graded supplier with a credible remediation plan is a better bet than a B-graded one that will not answer your questions. ## Buying it in India Any organisation can claim a free scorecard for its own domain, with no limit on users; paid plans for monitoring suppliers are priced by the number of organisations monitored and quoted, not listed.[3] Pricing is in US dollars; through a reseller it is invoiced in rupees with 18% GST added. For a regulated buyer the obligation is already dated. The RBI’s Master Direction on outsourcing of IT services (10 April 2023, in force 1 October 2023) requires banks and NBFCs to assess and monitor their IT service providers,[4] and SEBI’s CSCRF, in force since 31 August 2025, does the same for regulated market entities.[5] A rating is useful evidence of monitoring; the audit and inspection rights those rules require still have to be in the contract. The [third-party risk piece](https://www.thetechbag.com/blog/third-party-risk-management-security-ratings-must) sets ratings beside questionnaires and prices both. How we did this Figures as of 30 September 2026 The 2022 multiples, grade bands and validation sample are from SecurityScorecard’s “How Does Scoring Work?” paper (copyright 2022); the Scoring 3.0 multiples, issue-type count and breach sample are from its February 2024 infographic. Both are the vendor’s own figures, plotted as published; we have not re-run them and found no independent replication. The 2022 Medium post’s claim that low-rated firms rise “7 to 8 points in three months” after joining the platform could not be traced to a current SecurityScorecard document and is left out. Pricing is from the vendor’s pricing page, which prints no figures. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [SecurityScorecard, How Does Scoring Work? (2022 method: ten weighted factors; 100,000 organisations, 2,200 breaches; F = 7.7× A; grade bands)](https://securityscorecard.com/wp-content/uploads/2025/03/How-Does-Scoring-Work-0325.pdf) — copyright 2022 2. [SecurityScorecard, Scoring 3.0 infographic (issue-type weights only; 200+ issue types; 15,000+ breaches; F = 13.8× A)](https://securityscorecard.com/wp-content/uploads/2024/04/INFOGRAPHIC-Scoring-3.0-v2.pdf) — February 2024 3. [SecurityScorecard, pricing (free scorecard for your own domain, unlimited users; paid tiers priced by organisations monitored, quote-only)](https://securityscorecard.com/pricing/) — undated page 4. [Reserve Bank of India, Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102)](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12486) — 10 April 2023; in force 1 October 2023 5. [SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) — 20 August 2024; in force 31 August 2025 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Vulnerability and exposure management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — the scanners that see your outside before a rating does - [BFSI obligations: RBI, SEBI and CERT-In duties, dated](https://www.thetechbag.com/industries/bfsi/obligations) — the supplier-monitoring duties a rating supports