SecurityScorecard taps HackerOne to bring bug bounty data to security ratings

HackerOne and SecurityScorecard have announced a platform integration that will showcase data from the ethical hacking fraternity on a company’s digital scorecard.

SecurityScorecard, for the uninitiated, is a cybersecurity rating and risk-monitoring platform used by major companies such as Nokia, AXA, and Liberty Mutual, to monitor and asses security throughout their supply chain, including weaknesses in third-party vendors. It’s kind of like a credit score rating, but for security.

HackerOne, meanwhile, connects businesses with security researchers, or “white hat hackers,” who are incentivized financially to find software vulnerabilities before the bad guys do. The HackerOne platform has powered bug bounty programs for major businesses including Microsoft, Google, Intel, the U.S. Department of Defense, and Goldman Sachs. The San Francisco-based company recently touted major enterprise growth with nearly half of its new sales stemming from businesses with more than $1 billion in revenue.

Risk categories

SecurityScorecard uses 10 broad risk categories as part of its rating system, including endpoint security, network security, DNS health, and patching cadence. It also uses a risk category it calls “hacker chatter,” which automatically collects and analyzes conversations from popular public hacker community channels, such as private forums, social networks, and internet relay chat (IRC). It’s all about finding mentions of a business and its associated digital properties,to get a sense of whether any potential undisclosed exploits are being discussed.

Its latest partnership with HackerOne builds on that basic concept, though it instead surfaces official bug bounty and vulnerability disclosure data gleaned from HackerOne’s API.

For SecurityScorecard customers, a “hacker report” signal will appear on scorecards for companies that use HackerOne, though this is entirely opt-in.

Companies will be able to see recent security issues involving companies in their supply chain, and take appropriate action — this includes the ability to download a CSV file with all HackerOne findings.

But arguably more important than that, for companies that wish to be transparent about their vulnerability disclosure activities and the current status of flaws that have been identified, this integration goes some way toward achieving that.