All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Bitsight scores how secure an organization looks from the outside and sells that score to security teams, insurers and investors. Moody's invested $250 million, and Bitsight's capital markets page names S&P, LSEG and Solactive among firms building the rating into their own products. That reach is a head start rather than a lock. Bitsight sued the rival Black Kite over five patents, and Black Kite announced that a federal judge ruled the claims asserted from all five invalid in September 2024. The same order let its false-advertising counts proceed in part, and the docket records termination in February 2025. It announced a top Forrester current-offering score in 2026 and a Visionary placement from Gartner. It suits a buyer who wants one outside measure insurers and investors already read.
| Description | Bitsight rates the security posture of organizations and their vendors from internet-observable data, and sells exposure monitoring, third-party risk workflows and dark-web threat intelligence on the same platform. | [f1] |
|---|---|---|
| Founded | 2011 | [f2] |
| HQ | Boston, Massachusetts, United States | [f3] |
| Subsidiaries | Cybersixgill (Tel Aviv threat intelligence company, formed in 2014 and formerly called Sixgill. Bitsight announced the close of its $115 million acquisition in December 2024.) , ThirdPartyTrust, LLC (Named in the Bitsight privacy policy as a majority-owned subsidiary. Its vendor-assessment exchange sits behind the third-party risk products.) , NSEC Sistemas Informáticos, S.A. (Named in the Bitsight privacy policy as a majority-owned subsidiary.) | |
| Latest funding | $250M strategic investment from Moody's, September 2021, $2.4B valuation | [f4] |
| Product | What it does |
|---|---|
| Bitsight Security Ratings | A rating of an organization's security posture derived from externally observable data, refreshed continuously and shared with the rated organization and with third parties. |
| Bitsight Third-Party Risk Management | Continuous monitoring of third-, fourth- and nth-party vendors, drawing on a shared network of vendor profiles and triggering response workflows when a vendor's exposure changes. |
| Bitsight Vendor Risk Management | Vendor onboarding and assessment workflows that collect questionnaires and audit documents, summarize them automatically and check the answers against observed data. |
| Bitsight Security Posture Management | Discovery of an organization's own external attack surface with prioritization against threat activity and reporting on how posture changes over time. |
| Bitsight Cyber Threat Intelligence | Collection from open, deep and dark web sources covering compromised credentials, ransomware activity and adversary movements, tied to the customer's own attack surface. |
| Bitsight Professional Services | Managed vendor assessments, supplier remediation outreach, custom threat research and threat-exposure assessments delivered by Bitsight staff alongside the platform. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
Bitsight Security Posture Management discovers internet-facing assets, Bitsight Security Ratings scores the posture of an organization and its vendors, and Bitsight Cyber Threat Intelligence detects compromised credentials and ransomware activity. These are mapped to the Cyber Defense Matrix. [f1]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Bitsight names its buyers and states the problem precisely, that self-reported controls and point-in-time assessments left organizations without a continuous outside view of cyber risk. Forrester's analyst described chief information security officers in 2024 questioning the value of investing in these platforms, and no cited source quantifies what the gap costs, which holds this at the present-but-unproven level. [s2, s26, s27] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | Product pages document the collection mechanics concretely, from scanning more than 4 billion IP addresses to crawling 1,500 underground forums. The external validation point is reported independently rather than announced by the company, since an Information Security Media Group article on Forrester's 2024 evaluation places Bitsight second and records its criticisms. A critical evaluation is still an evaluation. Forrester published a further edition in 2026, recorded in its own analyst blog, and Bitsight announced the top current-offering score in it. [s1, s9, s26, s32, s20] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | Forrester published a further cybersecurity risk ratings evaluation in the second quarter of 2026, and its analyst wrote that reference customers now use these platforms mainly for third-party risk management rather than for monitoring their own footprint. Bitsight separately announced 30 percent growth in its insurance business in the half-year to July 2025. The independent signal points at a shifting use case rather than at growing demand for the rating itself, which holds this below the corroborated level. [s32, s21, s20] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | A granted United States patent names co-founder Stephen Boyer among its inventors and records the company as original assignee, and Boyer still holds an executive role fifteen years on. The reviewed sources carry no prior exit, no independent profile of the bench, and no account of the new chief executive's earlier roles beyond the company's own announcement. [s2, s5, s18, s28] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 | Named references span a global manufacturer's third-party risk programme run by its deputy chief information security officer and Belgium's national cybersecurity authority, and a SecurityWeek article states the Moody's investment behind a partnership whose products now carry Bitsight ratings. The customer, revenue and Fortune 500 counts are the company's own measurements with no filing behind them, which keeps this below the independently corroborated level. [s10, s11, s17, s22, s23, s25] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | A SecurityWeek article states more than 400 million dollars raised across six rounds and a 2.4 billion dollar valuation at the 2021 Moody's investment, and Bitsight reported in April 2025 that enterprise contracts above six figures then contributed nearly half of its recurring revenue. The 200 million dollars in annual recurring revenue and the positive free cash flow beside it are the company's own disclosures, so output per dollar is stated rather than confirmed. [s17, s25, s27] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | Buyers and analysts place Bitsight without vendor coaching, since Forrester has run a named cybersecurity risk ratings evaluation through both 2024 and 2026, an Information Security Media Group article on the 2024 edition places Bitsight at the top of it beside SecurityScorecard, and Moody's annual report defines the company by that category. Forrester's own analyst wrote in April 2026 that the influence of cyber risk ratings will diminish as intelligence becomes the primary source of value, which keeps this short of category-defining. [s26, s27, s32] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Bitsight's capital markets page names Moody's, S&P, LSEG and Solactive as firms carrying its ratings, and Bitsight states that customers using its data underwrite more than 5 billion dollars of cyber insurance, friction a platform vendor would reproduce only contract by contract. Black Kite announced that a court ruled the claims Bitsight asserted from five patents invalid. The same order let its false-advertising counts proceed in part and the case terminated in February 2025. The cited record names no asset a bundling platform could not assemble, so no structural moat appears. [s11, s15, s26, s30, s33, s35] |
Organizations cannot see the security posture of the companies they depend on, and the assessments they collect arrive stale. Bitsight's own framing is that it replaced self-reported controls and point-in-time assessments with an objective, continuous view of cyber risk when it created the category in 2011.
The buyer names the problem from outside the vendor as well. Forrester senior analyst Cody Scott told Information Security Media Group in May 2024 that chief information security officers historically questioned the value of investing in cybersecurity risk ratings platforms because of high false positive rates and limited return, to the point of saying it was not worth the investment. The same article records vendors since improving their ability to discover, attribute and validate assets.
The need reaches past security teams. Moody's carries Bitsight in the glossary of its annual report as a provider that helps global market participants understand cyber risk through ratings, analytics and performance management tools, and records a minority investment made in 2021. [s2, s26, s27]
Bitsight sells the products from one platform, which it describes as unifying real-time exposure and threat intelligence with vendor-sourced insights. It says it continuously scans over 4 billion IP addresses to discover assets, subsidiaries, cloud environments and supply chain exposure, monitors third-, fourth- and nth-party exposure across a network of more than 68,000 vendors, and benchmarks customers against a rated universe it puts at more than 325 million organizations.
The threat-intelligence products grew through acquisition. Bitsight announced the close of its Cybersixgill purchase in December 2024, a deal a CyberScoop article puts at 115 million dollars, and its Cyber Threat Intelligence page now describes tracking more than 700 advanced persistent threat groups, 4,000 types of malware and a billion compromised credentials a week, with 1,500 underground forums and marketplaces crawled continuously.
The company holds granted intellectual property in this area. A United States patent titled Security risk management carries patent-grant status and records BitSight Technologies Inc as original assignee, claiming a method for inferring an entity's security state from traces of online activity and mapping technical assets to the entities that own them. That record establishes the grant and the assignment rather than what the shipping products run, and it is one of the five patents whose asserted claims the court held invalid.
The litigation ran to a documented end. The order dismissing those five patent counts in September 2024 denied dismissal of Bitsight's false-advertising and related state-law counts, excluding any claim resting on security attestations beyond questionnaires and custom questionnaire mapping, and the docket records the case terminated in February 2025.
Analyst placements come from two firms. Bitsight announced that Forrester's second-quarter 2026 evaluation gave it the highest possible scores for asset discovery and attribution and for data source quality and integrity, and a Visionary placement in Gartner's 2026 Magic Quadrant for Cyber Threat Intelligence Technologies, published in May 2026. Both are the company's own account of those evaluations. [s1, s9, s12, s19, s20, s24, s28, s30, s33, s34, s35]
Bitsight competes inside a named analyst category with at least eight other vendors in it. An Information Security Media Group article of May 2024 states that Forrester's cybersecurity risk ratings evaluation placed Bitsight and SecurityScorecard at the top, Panorays climbing into the leaders, Black Kite, RiskRecon, BlueVoyant and Recorded Future as strong performers, and UpGuard and Prevalent as contenders.
That 2024 report records where Bitsight came second. SecurityScorecard held the top current-offering score in the 2024 edition and Bitsight took second place, and Forrester criticized Bitsight in that 2024 edition for complex pricing, for leaving peer benchmarks and fourth-party data out of the base offering, and for data shared through governance-tool integrations that did not match its own platforms. The margin between the two had narrowed since the previous evaluation, so a buyer comparing current capability was choosing between close alternatives.
Forrester published a further edition, the Cybersecurity Risk Ratings Platforms Wave of the second quarter of 2026, and its own analyst blog of 14 April 2026 records that publication. Bitsight announced that it received the top current-offering score in that 2026 edition, a placement the reviewed record carries only in the company's own words.
The category's own boundaries are moving. Cody Scott said in 2024 that he expected cybersecurity risk ratings to converge with third-party risk management, external attack surface management and cyber risk quantification. Forrester analyst Paul McKay wrote in April 2026 that ratings will not fade away overnight but their influence will diminish as the intelligence driving risk reduction becomes the primary source of value. Bitsight already sells third-party risk and exposure management alongside the rating, so the convergence Scott describes would move rivals onto ground it already occupies. [s26, s20, s32, s8, s13]
The scale figures are Bitsight's own measurements. Its customer pages state more than 3,500 customers, 38 percent of Fortune 500 companies, 180 or more government agencies and quasi-governmental authorities, and four of the top five investment banks. In April 2025 the company announced passing 200 million dollars in annual recurring revenue alongside positive free cash flow, and said enterprise contracts above six figures then contributed nearly half of that revenue.
Named references reach industry and government. A Bitsight customer story attributes the third-party risk work at Schneider Electric to its Cybersecurity Strategy and Governance teams under Mansur Abilkasimov, Deputy Global CISO, and a second describes the Centre for Cybersecurity Belgium, the national authority for cybersecurity in Belgium, using Bitsight to measure the country's posture.
Distribution runs through other companies' products. Bitsight's capital markets page names Moody's, Glass Lewis, Solactive, S&P and LSEG as firms that carry its ratings, and its October 2025 announcement reported 30 percent growth in the insurance business in the half-year to July 2025 alongside integration into Moody's RMS cyber solutions. [s10, s17, s22, s23, s11, s21]
Leadership changed at the top in 2026 while the technical founder stayed. Bitsight appointed John Clancy chief executive on 7 April 2026, effective immediately, and its team page lists Stephen Boyer as co-founder and Chief Innovation Officer.
The founding technical work is on the public record. A granted United States patent titled Security risk management lists Stephen Boyer among six inventors and records BitSight Technologies Inc as original assignee, which puts a founder on a method the company patented.
The reviewed sources describe the current executives in the company's own words. They carry no prior exit, no independent profile of the bench, and no account of Clancy's earlier roles beyond the appointment announcement, so a reader weighing the team has only the company's description of it. [s5, s18, s28]
Bitsight publishes its own security posture in detail and states its limits plainly. Its public information security statement says it completes an annual SOC 2 Type 2 report on the controls relevant to security, certifies under the EU-U.S., Swiss-U.S. and UK Extension of the Data Privacy Framework, and is TRUSTe APEC and PRP Enterprise Certified. Asked on the same page whether it holds ISO 27001, the company answers that it does not and points at its hosting provider's certification instead. Its own vendor risk product collects ISO 27001 certificates from vendors for review, so the certificate Bitsight does not hold is one its platform gathers from other companies.
The artifacts sit behind a request rather than in public. The page directs a reader to a Trust Management Hub profile holding the SOC 2 Type 2 report, internal policies, recent third-party penetration testing results and pre-completed assessment questionnaires, so a prospective buyer meets the list before the evidence.
Bitsight holds Cloud Security Alliance Trusted Cloud Provider status and invites security researchers into a managed bug bounty programme. [s6, s14]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| SecurityScorecard | competes with | Evaluated in Forrester's 2024 cybersecurity risk ratings report, where an Information Security Media Group article records it holding the top current-offering score with Bitsight second. | |
| Black Kite | competes with | Ranked a strong performer in Forrester's 2024 cybersecurity risk ratings report. Bitsight sued it for patent infringement in September 2023 and the docket records that case terminated in February 2025. | |
| Panorays | competes with | Named alongside Bitsight in Forrester's 2024 cybersecurity risk ratings report, where an Information Security Media Group article records it climbing into the leaders. | |
| RiskRecon | competes with | Listed as a strong performer in Forrester's 2024 cybersecurity risk ratings report, the same evaluation that placed Bitsight among the leaders. | |
| UpGuard | competes with | Listed as a contender in Forrester's 2024 cybersecurity risk ratings report, the same evaluation that placed Bitsight among the leaders. |
Add analyzed competitors to compare them side by side with Bitsight.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
press the advantage
Bitsight has accumulated fifteen years of external scanning and rating, and since the Cybersixgill close in December 2024 it also collects from underground forums. That data accrues to the company rather than sitting with each customer, and a funded rival could reproduce it. Forrester's 2024 evaluation ranked SecurityScorecard, Black Kite, RiskRecon, UpGuard and Panorays. Black Kite announced that a federal judge ruled the claims Bitsight asserted from five patents invalid in September 2024. The same order let its false-advertising counts proceed in part, and the docket records termination in February 2025. Its compliance package is ordinarily obtainable. Harder to match is the distribution its capital markets page describes, with the score inside Moody's and LSEG products.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 2/3 | Bitsight blends software with its own labour. Its services team monitors a customer's vendor ecosystem, performs proactive outreach and assists with vulnerability remediation, and sells custom reporting and managed threat-actor engagements, while the Schneider Electric story describes that team acting as an extension of the customer's internal team. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | A customer builds a vendor inventory inside the platform, uploads audit documents and questionnaires into it, and reaches the product through interfaces and integrations wired into tools it already runs. That is the data history, integrations and learned workflows of the middle level, and the cited record does not size what a migration would cost, so the mechanism is documented and the exit is not sized. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | Bitsight completes an annual SOC 2 Type 2 report, certifies under the EU, Swiss and UK Data Privacy Framework, and holds TRUSTe APEC and PRP certification, which are the entry costs of enterprise selling rather than barriers to replacement. Its own page states it does not hold ISO 27001, and no federal authorization appears in the reviewed sources. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Continuously scanning more than 4 billion IP addresses, attributing what is found to the right organizations, and crawling 1,500 underground forums for credentials and adversary activity is real-time work at internet scale. Bitsight names artificial intelligence and natural language processing as the methods behind that discovery, attribution and mapping. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | The buyers are regulated enterprises and governments. Bitsight's customer pages count 180 or more government agencies and quasi-governmental authorities and four of the top five investment banks, and its stories name Schneider Electric's deputy chief information security officer and the national cybersecurity authority of Belgium. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Bitsight runs beside a customer's stack rather than under it, feeding ratings and exposure findings into governance and workflow tools through application programming interfaces and integrations. Other firms build its ratings into commercial products of their own, and that dependence is a data feed a substitute ratings provider could replace rather than infrastructure a customer's own applications run on. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | Bitsight's own pages state more than 75 patents and fifteen years of mapping the external environment, a granted United States patent records the company as original assignee, and its threat-intelligence page counts more than 170 billion compromised credentials in its own database. The cited record names those assets and does not show them exclusive, so this is an accumulated advantage replicable with time and effort. |
Bitsight sells to two populations that want the same data for different reasons. Security and third-party risk teams buy continuous monitoring of their vendors and of their own external exposure, and Bitsight's security ratings page describes the rating as a tool used by security and risk leaders to assess, monitor, prioritize and communicate cyber risk.
The second population is financial. Bitsight's capital markets page offers the rating for pricing cyber risk into investment diligence, decisioning and underwriting, and names Moody's, Glass Lewis, Solactive, S&P and LSEG as the firms that carry it. Bitsight states that customers using its data underwrite more than 5 billion dollars in cyber insurance premiums.
Government is a third segment stated in the same voice. Bitsight's customer pages count 180 or more government agencies and quasi-governmental authorities, and its Centre for Cybersecurity Belgium story describes a national authority measuring a country's posture rather than a vendor portfolio.
Bitsight's platform pages put attribution alongside scanning as the core work, saying it continuously identifies assets, relationships and exposures and applies proprietary dynamic scoring. Separately, a United States patent assigned to the company claims a method for inferring an entity's security state from traces of online activity and building a map between technical assets and the entities associated with them. That record establishes the grant and the assignment rather than what the shipping product runs.
Bitsight names artificial intelligence and natural language processing as the methods behind vendor discovery and mapping. It announced that Forrester's second-quarter 2026 evaluation gave the highest possible scores to asset discovery and attribution and to data source acquisition and variety, which is the company's own account of that evaluation. It also announced a Visionary placement in Gartner's 2026 Magic Quadrant for Cyber Threat Intelligence Technologies, published in May 2026.
The threat-intelligence side is collection breadth. Bitsight's Cyber Threat Intelligence page describes crawling 1,500 underground forums and marketplaces continuously and holding more than 170 billion compromised credentials in its own database, with a billion added weekly.
Bitsight sells directly to enterprises, and other firms also build its ratings into products of their own. The direct motion shows up in named customer stories and in an April 2025 statement that enterprise contracts above six figures contributed nearly half of annual recurring revenue, with half of new revenue coming from customer expansion.
The indirect motion is a data business. Bitsight's capital markets page says Moody's integrates its ratings into its risk solutions, that S&P maps them to individual securities for asset managers, that LSEG places them in due-diligence reports, that Glass Lewis puts them in proxy research, and that Solactive builds cyber risk indices on them.
Insurance is a separately reported line. Bitsight announced 30 percent growth in its insurance business in the half-year to July 2025, attributed to a deepening collaboration with Moody's RMS and to new insurance datasets, and cites Gallagher Re finding that adding Bitsight scanning insights lets insurers identify companies disproportionately at risk of a claim up to 40 percent more accurately.
Bitsight publishes packages rather than prices. Its pricing page asks a buyer to compare packages and connect with the team to build a solution aligned to their security goals, and presents a Continuous Monitoring tier alongside an Expanded Risk Coverage tier that adds Vendor Risk Management.
Vendor count is one axis among several. Each third-party risk tier is banded to scale with the vendor ecosystem, from 1 to 50 vendors through 51 to 100, 101 to 500 and unlimited, and the pricing FAQ says pricing also varies with the solutions, capabilities and level of support an organization needs. Prices are requested rather than listed.
Packaging is where the analyst criticism landed. Forrester criticized Bitsight in 2024 for complex pricing and for leaving peer benchmarks and fourth-party data functionality out of the base offering, and Bitsight answered that its pricing is competitive given the comprehensiveness and modularity of the solution.
Bitsight delivers software the customer's own team operates, with a staffed service alongside it. The platform, its application programming interfaces, integrations and data feeds are the primary surface, and Bitsight describes agent-ready access patterns as an emerging one.
The service layer is staffed rather than nominal. Bitsight's third-party risk professional services team runs managed vendor assessments without adding customer headcount, and the Schneider Electric story describes that team acting as an extension of the customer's internal team.
Hosting is stated plainly. Bitsight says it is a software-as-a-service platform entirely cloud-based in Amazon Web Services and operates no physical servers, routers, load balancers or name servers of its own.
Bitsight documents its own assurance posture and marks its gaps. It completes an annual SOC 2 Type 2 report on the controls relevant to security, certifies under the EU-U.S., Swiss-U.S. and UK Extension of the Data Privacy Framework, holds TRUSTe APEC and PRP Enterprise certification, and states on the same page that it does not hold ISO 27001, a certificate its own vendor risk product collects from other companies.
Evidence is available on request rather than published. A Trust Management Hub profile holds the SOC 2 Type 2 report, internal policies, recent third-party penetration testing results and pre-completed assessment questionnaires, and readers reach it by asking.
Bitsight holds Cloud Security Alliance Trusted Cloud Provider status, invites security researchers into a managed bug bounty, and its chief risk officer told Information Security Media Group in 2024 that the company created a public dispute resolution process and publishes rating changes online.
Much of Bitsight's ecosystem reaches buyers outside security. Bitsight's capital markets page names Moody's, Glass Lewis, Solactive, S&P and LSEG as firms embedding the rating in a product of their own, which puts Bitsight data in front of investors, proxy voters, index buyers and diligence teams who never log into the platform.
Inside security the ecosystem is conventional. Bitsight exposes application programming interfaces, integrations and data feeds, and describes agent-ready access patterns for the tools teams already run.
The vendor network is the part customers touch. Bitsight counts more than 68,000 vendors in the network its third-party monitoring draws on, and its vendor risk product invites a customer's own vendors in and collects their questionnaires, SOC 2 reports and certifications into one dashboard.
The company runs under a chief executive appointed in April 2026 with a co-founder still in an executive seat. Bitsight named John Clancy chief executive effective immediately on 7 April 2026, and its team page lists Stephen Boyer as co-founder and Chief Innovation Officer.
The founding technical claim is verifiable outside the company's pages. A granted United States patent titled Security risk management lists Stephen Boyer among six inventors and records BitSight Technologies Inc as original assignee.
The rest of the bench is described only in the company's own voice, and the reviewed sources carry no independent account of its record, so a buyer weighing the team has the company's word for it.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Bitsight: platform overview page | official | 2026-08-20 |
| f2 | Bitsight: Our Story page | official | 2026-08-20 |
| f3 | Bitsight: home page | official | 2026-08-20 |
| f4 | SecurityWeek: BitSight Raises $250 Million at $2.4 Billion Valuation | press | 2026-08-20 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Bitsight: home page “Bitsight delivers a dynamic map of assets and vulnerabilities — prioritized by real-time threat intelligence — across your enterprise and supply chain, so your team can act before risk becomes an incident.” | official | 2026-08-20 |
| s2 | Bitsight: Our Story page “Bitsight created the security ratings category in 2011, replacing self-reported controls and point-in-time assessments with an objective, continuous view of cyber risk.” | official | 2026-08-20 |
| s5 | Bitsight: Our Team page “We are a team with deep experience in internet security, networking, and risk management. Collectively, we have a passion for using data to solve the biggest cyber risk business challenges.” | official | 2026-08-20 |
| s6 | Bitsight: Public Information Security Statement “Yes! BitSight completes an annual SOC 2 Type 2 report on the controls relevant to security. We are certified under the E.U.-U.S., Swiss-U.S., and UK Extension of the Data Privacy Framework, and are TRUSTe APEC and PRP Enterprise Certified.” | official | 2026-08-20 |
| s7 | Bitsight: Security Ratings product page “The Bitsight Security Rating is a powerful tool used by security and risk leaders to assess, monitor, prioritize, and communicate cyber risk. It provides an objective, data-driven lens to view the health of an organization’s cyber security program.” | official | 2026-08-20 |
| s8 | Bitsight: Third-Party Risk Management product page “Get comprehensive, continuous visibility into every vendor, fourth-party connection, and digital asset across your supply chain — from 40M+ monitored companies to our network of 75K+ vendor profiles.” | official | 2026-08-20 |
| s9 | Bitsight: Cyber Threat Intelligence product page “We track over 700+ APT groups, 4,000+ types of malware, 95 million threat actors, 6 million unique IOCs and 1 billion compromised credentials per week. Leveraging Bitsight AI to enrich this data, we provide security teams with context and comprehensive insight into the nature and source of each” | official | 2026-08-20 |
| s10 | Bitsight: customer stories index “We’ve been helping companies and governments for over a decade. See how we empower our 3,500+ customers to reduce their cyber risk.” | official | 2026-08-20 |
| s11 | Bitsight: capital markets page “Moody’s and Bitsight share a common goal of helping leaders make better risk decisions with data. Bitsight’s cybersecurity ratings and analytics are integrated into Moody’s suite of comprehensive risk solutions. Moody’s has produced over 30 research publications featuring Bitsight data, including” | official | 2026-08-20 |
| s12 | Bitsight: platform overview page “The Bitsight Cyber Risk Intelligence Platform unifies real-time exposure and threat intelligence with vendor-sourced insights to help security leaders detect, defend, and respond to risk.” | official | 2026-08-20 |
| s13 | Bitsight: Security Posture Management product page “Bitsight Security Posture Management (SPM) delivers a continuous, threat-informed view of enterprise posture, grounded in independently validated data trusted across global markets. SPM helps leaders prioritize attacker-relevant exposure, validate control effectiveness, and demonstrate measurable” | official | 2026-08-20 |
| s14 | Bitsight: Vendor Risk Management product page “Bitsight Vendor Risk Management helps risk and security teams remove the complexity of managing a growing vendor portfolio. From building your third party inventory through automated invitations, to consolidating document collection in one dashboard, to continuously assessing vendor security” | official | 2026-08-20 |
| s15 | Bitsight: data correlation to outcomes page “More than $5B in cyber insurance premiums are underwritten by customers leveraging Bitsight data because of the correlation to real-world outcomes. One of the largest cyber insurance studies of its kind conducted by Gallagher Re leveraging Bitsight data found insurers. Organizations with poor” | official | 2026-08-20 |
| s16 | Bitsight: Professional Services page “Bitsight Professional Services enables customers to realize maximum value right away through a dedicated advisor. No matter where you are in your cyber risk program, our team can accelerate any program’s maturity by augmenting your operation and mentoring your staff.” | official | 2026-08-20 |
| s17 | Bitsight press release: annual recurring revenue milestone “BOSTON – April 28, 2025 – Bitsight , the global leader in cyber risk intelligence, today announced it has surpassed $200 million in annual recurring revenue (ARR). The milestone builds on the company’s strong close to the previous fiscal year, which included positive free cash flow, and reflects” | official | 2026-08-20 |
| s18 | Bitsight press release: chief executive appointment “BOSTON, Mass. — April 7, 2026 — Bitsight, the global leader in cyber risk intelligence, today announced that it has appointed John Clancy as its chief executive officer, effective immediately.” | official | 2026-08-20 |
| s19 | Bitsight press release: Cybersixgill acquisition close “BOSTON – Dec. 11, 2024 – Bitsight , the global leader in cyber risk management, today announced the successful closing of its acquisition of Cybersixgill , a leading provider of real-time cyber threat intelligence. This marks a significant milestone in Bitsight’s mission to help enterprises” | official | 2026-08-20 |
| s20 | Bitsight press release, April 2026: Forrester Wave Q2 2026 placement announcement “BOSTON – April 9 , 2026 – Bitsight, the global leader in cyber risk intelligence, today announced it has been named a Leader in The Forrester Wave™: Cybersecurity Risk Ratings Platforms, Q2 2026 , receiving the highest possible scores across 11 criteria, the most of all vendors evaluated.” | official | 2026-08-20 |
| s21 | Bitsight press release: insurance business growth “BOSTON – Oct 9, 2025 – Bitsight, the global leader in cyber risk intelligence, today announced record 30% growth in its insurance business for the first half of its fiscal year. 1 This growth milestone was fueled by Bitsight’s expanded partnership with Moody’s , new insurance datasets and product” | official | 2026-08-20 |
| s22 | Bitsight customer story: Schneider Electric “Schneider Electric’s Cybersecurity Strategy and Governance teams (further “team” in the text) led by Mansur Abilkasimov, Deputy Global CISO, Vice President in charge of Cybersecurity strategy , integrated Bitsight’s Third-Party Risk Management technology and advisory capabilities into their” | official | 2026-08-20 |
| s23 | Bitsight customer story: Centre for Cybersecurity Belgium “The Centre for Cybersecurity Belgium (CCB) is the national authority for cybersecurity in Belgium. The CCB supervises, coordinates, and monitors the application of the Belgian cybersecurity strategy. The CCB’s mission is to ensure coordination and information exchange so that Belgian companies,” | official | 2026-08-20 |
| s24 | CyberScoop, November 2024: Bitsight agrees to acquire Cybersixgill for $115 million “BitSight Technologies, Inc. announced an agreement Thursday to acquire the cyber threat intelligence firm Cybersixgill for $115 million.” | press | 2026-08-20 |
| s25 | SecurityWeek: BitSight Raises $250 Million at $2.4 Billion Valuation “Cybersecurity ratings company BitSight on Monday announced receiving a $250 million investment from credit ratings giant Moody’s in a deal valuing BitSight at $2.4 billion.” | press | 2026-08-20 |
| s26 | Information Security Media Group, May 2024: Bitsight, SecurityScorecard, Panorays Lead Risk Ratings Tech “Bitsight and SecurityScorecard remained atop Forrester's cybersecurity risk ratings platforms rankings, while Panorays climbed into the leaders' space.” | press | 2026-08-20 |
| s27 | SEC EDGAR: Moody's Corporation Form 10-K for the year ended December 31, 2025 “BitSight A provider that helps global market participants understand cyber risk through ratings, analytics, and performance management tools; the Company acquired a minority investment in BitSight in 2021” | regulatory | 2026-08-20 |
| s28 | Google Patents: US9438615B2, Security risk management “US9438615B2 - Security risk management” | other | 2026-08-20 |
| s31 | Bitsight: pricing and packaging page “Compare Bitsight packages and connect with our team to build a solution aligned to your security goals, risk profile, and operational priorities.” | official | 2026-08-20 |
| s30 | Black Kite press release: court ruling on Bitsight patent claims “Black Kite , the leader in third-party cyber risk intelligence, today announced that on September 20, 2024, in the United States District Court for the District of Massachusetts, the judge presiding over a lawsuit filed by Bitsight Technologies, Inc. against Black Kite, Bitsight Technologies, Inc.” | official | 2026-08-20 |
| s32 | Forrester blog, 14 April 2026: Cyber Risk Ratings Fade Out, Actionable Intelligence Takes The Spotlight “With the publication of The Forrester Wave™: Cybersecurity Risk Ratings Platforms, Q2 2026 this week, that limitation became indisputably clear. Reference customers I spoke to, along with vendors themselves, are now looking beyond ratings as an outcome. Instead, they are focused on how the data” | research | 2026-08-20 |
| s33 | CourtListener RECAP search API: docket record for BitSight Technologies, Inc. v. NormShield Inc., 1:23-cv-12055 (D. Mass.) “"caseName":"BitSight Technologies, Inc. v. NormShield Inc.","case_name_full":"","cause":"35:271 Patent Infringement","chapter":null,"court":"District Court, D. Massachusetts","court_citation_string":"D. Mass.","court_id":"mad","dateArgued":null,"dateFiled":"2023-09-05","dateTerminated":"2025-02-13"” | other | 2026-08-20 |
| s34 | Bitsight press release, May 2026: Gartner Magic Quadrant for Cyber Threat Intelligence Technologies placement announcement “today announced it has been named a Visionary in the inaugural Gartner Magic Quadrant for Cyber Threat Intelligence Technologies .” | official | 2026-08-20 |
| s35 | D. Mass.: Memorandum and Order on Motion to Dismiss, BitSight Technologies v. NormShield, 23-cv-12055-MJJ, September 20, 2024, defendant-hosted copy “For the foregoing reasons, Black Kite’s Motion to Dismiss is GRANTED in part and DENIED in part. It is granted as to BitSight’s patent infringement claims, Counts 1 through 5.” | regulatory | 2026-08-20 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Bitsight: home page “Bitsight delivers a dynamic map of assets and vulnerabilities — prioritized by real-time threat intelligence — across your enterprise and supply chain, so your team can act before risk becomes an incident.” | official | 2026-08-20 |
| s2 | Bitsight: Our Story page “Bitsight created the security ratings category in 2011, replacing self-reported controls and point-in-time assessments with an objective, continuous view of cyber risk.” | official | 2026-08-20 |
| s5 | Bitsight: Our Team page “We are a team with deep experience in internet security, networking, and risk management. Collectively, we have a passion for using data to solve the biggest cyber risk business challenges.” | official | 2026-08-20 |
| s6 | Bitsight: Public Information Security Statement “Yes! BitSight completes an annual SOC 2 Type 2 report on the controls relevant to security. We are certified under the E.U.-U.S., Swiss-U.S., and UK Extension of the Data Privacy Framework, and are TRUSTe APEC and PRP Enterprise Certified.” | official | 2026-08-20 |
| s7 | Bitsight: Security Ratings product page “The Bitsight Security Rating is a powerful tool used by security and risk leaders to assess, monitor, prioritize, and communicate cyber risk. It provides an objective, data-driven lens to view the health of an organization’s cyber security program.” | official | 2026-08-20 |
| s8 | Bitsight: Third-Party Risk Management product page “Get comprehensive, continuous visibility into every vendor, fourth-party connection, and digital asset across your supply chain — from 40M+ monitored companies to our network of 75K+ vendor profiles.” | official | 2026-08-20 |
| s9 | Bitsight: Cyber Threat Intelligence product page “We track over 700+ APT groups, 4,000+ types of malware, 95 million threat actors, 6 million unique IOCs and 1 billion compromised credentials per week. Leveraging Bitsight AI to enrich this data, we provide security teams with context and comprehensive insight into the nature and source of each” | official | 2026-08-20 |
| s10 | Bitsight: customer stories index “We’ve been helping companies and governments for over a decade. See how we empower our 3,500+ customers to reduce their cyber risk.” | official | 2026-08-20 |
| s11 | Bitsight: capital markets page “Moody’s and Bitsight share a common goal of helping leaders make better risk decisions with data. Bitsight’s cybersecurity ratings and analytics are integrated into Moody’s suite of comprehensive risk solutions. Moody’s has produced over 30 research publications featuring Bitsight data, including” | official | 2026-08-20 |
| s12 | Bitsight: platform overview page “The Bitsight Cyber Risk Intelligence Platform unifies real-time exposure and threat intelligence with vendor-sourced insights to help security leaders detect, defend, and respond to risk.” | official | 2026-08-20 |
| s13 | Bitsight: Security Posture Management product page “Bitsight Security Posture Management (SPM) delivers a continuous, threat-informed view of enterprise posture, grounded in independently validated data trusted across global markets. SPM helps leaders prioritize attacker-relevant exposure, validate control effectiveness, and demonstrate measurable” | official | 2026-08-20 |
| s14 | Bitsight: Vendor Risk Management product page “Bitsight Vendor Risk Management helps risk and security teams remove the complexity of managing a growing vendor portfolio. From building your third party inventory through automated invitations, to consolidating document collection in one dashboard, to continuously assessing vendor security” | official | 2026-08-20 |
| s15 | Bitsight: data correlation to outcomes page “More than $5B in cyber insurance premiums are underwritten by customers leveraging Bitsight data because of the correlation to real-world outcomes. One of the largest cyber insurance studies of its kind conducted by Gallagher Re leveraging Bitsight data found insurers. Organizations with poor” | official | 2026-08-20 |
| s16 | Bitsight: Professional Services page “Bitsight Professional Services enables customers to realize maximum value right away through a dedicated advisor. No matter where you are in your cyber risk program, our team can accelerate any program’s maturity by augmenting your operation and mentoring your staff.” | official | 2026-08-20 |
| s17 | Bitsight press release: annual recurring revenue milestone “BOSTON – April 28, 2025 – Bitsight , the global leader in cyber risk intelligence, today announced it has surpassed $200 million in annual recurring revenue (ARR). The milestone builds on the company’s strong close to the previous fiscal year, which included positive free cash flow, and reflects” | official | 2026-08-20 |
| s18 | Bitsight press release: chief executive appointment “BOSTON, Mass. — April 7, 2026 — Bitsight, the global leader in cyber risk intelligence, today announced that it has appointed John Clancy as its chief executive officer, effective immediately.” | official | 2026-08-20 |
| s19 | Bitsight press release: Cybersixgill acquisition close “BOSTON – Dec. 11, 2024 – Bitsight , the global leader in cyber risk management, today announced the successful closing of its acquisition of Cybersixgill , a leading provider of real-time cyber threat intelligence. This marks a significant milestone in Bitsight’s mission to help enterprises” | official | 2026-08-20 |
| s20 | Bitsight press release, April 2026: Forrester Wave Q2 2026 placement announcement “BOSTON – April 9 , 2026 – Bitsight, the global leader in cyber risk intelligence, today announced it has been named a Leader in The Forrester Wave™: Cybersecurity Risk Ratings Platforms, Q2 2026 , receiving the highest possible scores across 11 criteria, the most of all vendors evaluated.” | official | 2026-08-20 |
| s21 | Bitsight press release: insurance business growth “BOSTON – Oct 9, 2025 – Bitsight, the global leader in cyber risk intelligence, today announced record 30% growth in its insurance business for the first half of its fiscal year. 1 This growth milestone was fueled by Bitsight’s expanded partnership with Moody’s , new insurance datasets and product” | official | 2026-08-20 |
| s22 | Bitsight customer story: Schneider Electric “Schneider Electric’s Cybersecurity Strategy and Governance teams (further “team” in the text) led by Mansur Abilkasimov, Deputy Global CISO, Vice President in charge of Cybersecurity strategy , integrated Bitsight’s Third-Party Risk Management technology and advisory capabilities into their” | official | 2026-08-20 |
| s23 | Bitsight customer story: Centre for Cybersecurity Belgium “The Centre for Cybersecurity Belgium (CCB) is the national authority for cybersecurity in Belgium. The CCB supervises, coordinates, and monitors the application of the Belgian cybersecurity strategy. The CCB’s mission is to ensure coordination and information exchange so that Belgian companies,” | official | 2026-08-20 |
| s24 | CyberScoop, November 2024: Bitsight agrees to acquire Cybersixgill for $115 million “BitSight Technologies, Inc. announced an agreement Thursday to acquire the cyber threat intelligence firm Cybersixgill for $115 million.” | press | 2026-08-20 |
| s25 | SecurityWeek: BitSight Raises $250 Million at $2.4 Billion Valuation “Cybersecurity ratings company BitSight on Monday announced receiving a $250 million investment from credit ratings giant Moody’s in a deal valuing BitSight at $2.4 billion.” | press | 2026-08-20 |
| s26 | Information Security Media Group, May 2024: Bitsight, SecurityScorecard, Panorays Lead Risk Ratings Tech “Bitsight and SecurityScorecard remained atop Forrester's cybersecurity risk ratings platforms rankings, while Panorays climbed into the leaders' space.” | press | 2026-08-20 |
| s27 | SEC EDGAR: Moody's Corporation Form 10-K for the year ended December 31, 2025 “BitSight A provider that helps global market participants understand cyber risk through ratings, analytics, and performance management tools; the Company acquired a minority investment in BitSight in 2021” | regulatory | 2026-08-20 |
| s28 | Google Patents: US9438615B2, Security risk management “US9438615B2 - Security risk management” | other | 2026-08-20 |
| s31 | Bitsight: pricing and packaging page “Compare Bitsight packages and connect with our team to build a solution aligned to your security goals, risk profile, and operational priorities.” | official | 2026-08-20 |
| s30 | Black Kite press release: court ruling on Bitsight patent claims “Black Kite , the leader in third-party cyber risk intelligence, today announced that on September 20, 2024, in the United States District Court for the District of Massachusetts, the judge presiding over a lawsuit filed by Bitsight Technologies, Inc. against Black Kite, Bitsight Technologies, Inc.” | official | 2026-08-20 |
| s32 | Forrester blog, 14 April 2026: Cyber Risk Ratings Fade Out, Actionable Intelligence Takes The Spotlight “With the publication of The Forrester Wave™: Cybersecurity Risk Ratings Platforms, Q2 2026 this week, that limitation became indisputably clear. Reference customers I spoke to, along with vendors themselves, are now looking beyond ratings as an outcome. Instead, they are focused on how the data” | research | 2026-08-20 |
| s33 | CourtListener RECAP search API: docket record for BitSight Technologies, Inc. v. NormShield Inc., 1:23-cv-12055 (D. Mass.) “"caseName":"BitSight Technologies, Inc. v. NormShield Inc.","case_name_full":"","cause":"35:271 Patent Infringement","chapter":null,"court":"District Court, D. Massachusetts","court_citation_string":"D. Mass.","court_id":"mad","dateArgued":null,"dateFiled":"2023-09-05","dateTerminated":"2025-02-13"” | other | 2026-08-20 |
| s34 | Bitsight press release, May 2026: Gartner Magic Quadrant for Cyber Threat Intelligence Technologies placement announcement “today announced it has been named a Visionary in the inaugural Gartner Magic Quadrant for Cyber Threat Intelligence Technologies .” | official | 2026-08-20 |
| s35 | D. Mass.: Memorandum and Order on Motion to Dismiss, BitSight Technologies v. NormShield, 23-cv-12055-MJJ, September 20, 2024, defendant-hosted copy “For the foregoing reasons, Black Kite’s Motion to Dismiss is GRANTED in part and DENIED in part. It is granted as to BitSight’s patent infringement claims, Counts 1 through 5.” | regulatory | 2026-08-20 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.