General Provisions
Release of Functionality: SecurityScorecard is not obligated to, and makes no representations that it will, generally release functionality in development.
Contingency: Purchases are not contingent on the delivery of any future functionality or features, or dependent on any oral or written comments regarding future functionality.
Legend: ☑ Included | ☐ Not included
TITAN AI: Watch, Assess, Secure, OS
TPRM platform for end-to-end management of third-party cyber risks. Includes security ratings (TITAN Watch), AI-native assessments (TITAN Assess), and threat-informed TPRM (TITAN Secure) capabilities.
| CAPABILITY CATEGORY | CAPABILITY | WATCH | ASSESS | SECURE | OS | DEFINITIONS |
| Organization-level risk analysis | Security rating scorecard | ☑ | ☑ | ☑ | ☑ | Current and historical analysis of a single organization's security posture based on findings attributable to its digital footprint. |
| Digital footprint | ☑ | ☑ | ☑ | ☑ | The set of IPs and domains SecurityScorecard attributes to an organization’s Scorecard. Findings and scores are based on these assets. You can review it, claim or request removal of assets, categorize assets, and assign ownership of assets and issues to team members. | |
| Hierarchy | ☑ | ☑ | ☑ | ☑ | A parent-child structure that maps an organization’s subsidiaries | |
| Custom scorecard | ☑ | ☑ | ☑ | ☑ | Scorecard based on a user-defined set of domains and IPs. | |
| ChatSSC | ☑ | ☑ | ☑ | ☑ | Conversational AI agent for analyzing SecurityScorecard platform data. | |
| Single framework compliance mapping | ☑ | ☑ | ☑ | ☑ | Analysis of an organization's adherence to a compliance standard based on external security posture data. Only one pre-built compliance framework can be used at a time. | |
| Multiple and custom compliance framework mapping | ☑ | ☑ | ☑ | ☑ | Analysis of an organization's adherence to a compliance standard based on external security posture data. Multiple pre-built compliance frameworks and the ability to create custom frameworks is available. | |
| Score planner | ☑ | ☑ | ☑ | ☑ | A tool that shows how fixing specific issues would change your score. You pick a target letter grade, and it calculates the fewest issues and findings you’d need to fix to reach it. | |
| Action plans | ☑ | ☑ | ☑ | ☑ | Collaboration tool for asking vendors to fix specific security issues. You set an objective (overall score, factor scores, or particular issues), a deadline, and targets, and the vendor marks issues “Fixed,” which triggers a rescan. | |
| Cyber risk quantification | Add-on | Add-on | Add-on | Add-on | Financial impact analysis powered by an integration with Dataminr. | |
| Vendor management | Self-service vendor intake with auto risk-tiering | ☑ | ☑ | ☑ | ☑ | Configurable intake form that lets a business partner request a new vendor; automatically classifies it into a risk tier and triggers the matching questionnaire, with admin review before the vendor is added. |
| Tagging | ☑ | ☑ | ☑ | ☑ | The ability for users to add custom meta data attributes to an object such as a vendor or even asset or finding | |
| Contact manager | ☑ | ☑ | ☑ | ☑ | A central place to create and manage internal and external contacts. It also tracks vendor and partner invitations, so you can filter by status and resend invitations that haven't been accepted. | |
| Secure document storage | ☑ | ☑ | ☑ | ☑ | Policy-driven storage for sensitive documents like compliance reports, security artifacts, and contractual materials used across Titan AI workflows. Stored files are shared across your organization, allowing team members to access, manage, and reuse documents as needed. | |
| Communication center | ☐ | ☑ | ☑ | ☑ | Single timeline of every outbound and inbound vendor message — response requests, remediation requests, questionnaires, replies — with delivery status and thread history. | |
| Self-service vendor intake with auto risk-tiering | ☐ | ☑ | ☑ | ☑ | Configurable intake form that lets a business partner request a new vendor; automatically classifies it into a risk tier and triggers the matching questionnaire, with admin review before the vendor is added. | |
| Continuous monitoring | Unlimited partial monitoring | Add-on | Add-on | Add-on | Add-on | Continuous visibility of a subset of a scorecard's data for an unrestricted number of organizations. Includes alerting of changes in scores and detected breaches. |
| 3rd and 4th party vendor discovery | ☐ | ☐ | ☑ | ☑ | Automated identification of an organization's likely business relationships based on evidentiary analysis of sources like HTTP requests, mail exchanges and job postings. | |
| Product search within vendor ecosystem | ☐ | ☐ | ☑ | ☑ | Identification of specific software products used by third and fourth parties. | |
| Threat-informed findings presets | ☐ | ☐ | ☑ | ☑ | Six curated triage lenses built by SecurityScorecard's STRIKE threat team (e.g., Actively Exploited CVEs, Ransomware Kill Chain) that surface findings tied to active attacker activity instead of a static score. | |
| Finding- and CVE-level targeted remediation requests | ☐ | ☐ | ☑ | ☑ | Select one or more specific findings or CVEs from a vendor's profile and send a targeted remediation request for exactly those items, with per-item tracking. | |
| Auto-rescan verification | ☑ | ☑ | ☑ | ☑ | Automatically rescans a vendor's asset when a fix is claimed; reopens the finding if it's still present. | |
| Issue-to-owner routing | ☐ | ☐ | ☑ | ☑ | Routes a specific finding directly to the internal or vendor-side owner responsible for fixing it. | |
| Events feed with impact translation | ☐ | ☐ | ☑ | ☑ | Maps breaches, alleged breaches, and vendor outages to portfolio vendors and detected fourth parties, classified as named victim vs. detected connection. | |
| Coordinated vendor response workflow | ☐ | ☐ | ☑ | ☑ | Two-step wizard to select impacted vendors and send templated response requests, with replies auto-updating status (Investigating, Affected, Not affected, Remediated). | |
| Single-response propagation | ☐ | ☐ | ☑ | ☑ | A vendor's response to an impact inquiry automatically updates status for every customer monitoring that vendor, not just the one who asked. | |
| Fourth-party concentration risk mapping | ☐ | ☐ | ☑ | ☑ | Automatically detects fourth parties from libraries, HTTP requests, DNS, and other signals, ranked by how many portfolio vendors share each one. Also provides visibility to the products being used by those vendors. | |
| Reporting | Basic report creation | ☑ | ☑ | ☑ | ☑ | Pre-built dashboards and reports from SecurityScorecard. |
| Exportable reports (SSC branded) | ☑ | ☑ | ☑ | ☑ | Formatted data export of scorecard data. | |
| Advanced report creation | ☑ | ☑ | ☑ | ☑ | Custom reports, report scheduling, and data retention capabilities. | |
| Exportable reports (co-branded and white-labeled) | ☑ | ☑ | ☑ | ☑ | Formatted data export of scorecard data with user-defined branded elements. | |
| Vendor risk management dashboard | ☑ | ☑ | ☑ | ☑ | The main tab of the Third-party risk management dashboard. It tracks breach likelihood across your vendors or a single Portfolio, with tiles for recent incidents, critical-impact vendors, and grade distribution. Each tile links to a filtered vendor list. | |
| Vendor engagement dashboard | ☑ | ☑ | ☑ | ☑ | The second tab of the same dashboard. It tracks your outreach to vendors: evidence requests, questionnaire status (including overdue ones), Action Plan status, and how many vendors are active (logged in within 90 days). | |
| Self-monitoring launchpad | ☑ | ☑ | ☑ | ☑ | The view where you monitor your own organization’s Scorecard. | |
| Supply Chain Risk Dashboard | ☑ | ☑ | ☑ | ☑ | Pre-built dashboard with drill-through to underlying observations and per-widget CSV export. Includes Real-time widgets showing active security events affecting the portfolio, triage status, and confirmed vendor impact. | |
| Workflow and user management | Federated single sign-on | ☑ | ☑ | ☑ | ☑ | User authentication with the organization’s own identity management system. |
| Role-based access controls (RBAC) | ☑ | ☑ | ☑ | ☑ | Capabilities for platform administrators to control user permissions. | |
| Basic rules and alerts configuration | ☑ | ☑ | ☑ | ☑ | Automation based on single statement conditions defined by platform users. | |
| Basic integrations | ☑ | ☐ | ☐ | ☐ | Basic integrations embed SecurityScorecard data into everyday security and business tools to improve visibility and streamline simple workflows. They make it easy to share insights and take lightweight actions without requiring deep configuration or process changes.
| |
| Advanced integrations | ☑ | ☐ | ☐ | ☐ | Advanced integrations deeply connect SecurityScorecard with core systems of record, enabling automated workflows, bi-directional data exchange, and end-to-end risk management processes. They support operational scale by embedding cyber risk intelligence directly into critical enterprise workflows.
| |
| AI agents | ☑ | ☑ | ☑ | ☑ | Additional AI-powered capabilities that support remediation, reporting, and TPRM workflows. | |
Audit logs
| ☑ | ☑ | ☑ | ☑ | Records of platform activity for admins. The User Audit Log shows logins and access by date range and role (My Settings > Admin). Custom scorecards have a log of what changed, who changed it, and when. The Evidence Locker has an activity log of file uploads and deletions. | |
| APIs for custom integrations | ☑ | ☑ | ☑ | ☑ | APIs for users to build tailored connections between the SecurityScorecard platform and other software systems. | |
| Visual workflow canvas builder | ☐ | ☑ | ☑ | ☑ | Drag-and-drop canvas for building multi-step automations — trigger, data, decision, action, and delay blocks chained together — with no code required. | |
| Workflow templates library | ☐ | ☑ | ☑ | ☑ | Collection of pre-built workflows that the user can implement as is or customize to meet their unique policies and procedures. | |
| Workflow execution manager and logs | ☐ | ☑ | ☑ | ☑ | Full operational control (start, stop, retry, inspect) over every automation run, plus searchable logs of every past execution and failure. | |
| MCP server | ☐ | ☑ | ☑ | ☑ | TITAN AI MCP server for AI-tooling integrations. | |
| Questionnaire management | Pre-built template questionnaire creation | ☐ | ☑ | ☐ | ☑ | Creation and distribution of questionnaires using formats defined by SecurityScorecard. An unlimited number of questionnaires can be sent to the organization being assessed. |
| AI-powered document analysis | ☑ | ☑ | ☑ | ☑ | Conversational search and querying of unstructured documents provided by vendors as evidence of security requirements. | |
| Custom questionnaire creation | ☐ | ☑ | ☐ | ☑ | Creation and distribution of questionnaires using formats defined by platform users. | |
| AI questionnaire template agent | ☐ | ☑ | ☐ | ☑ | Chat interface that builds or edits a questionnaire from scratch in plain language, applying bulk changes across sections and questions in one command. | |
| Auto-import of existing questionnaires | ☐ | ☑ | ☐ | ☑ | Imports an existing questionnaire from Excel, CSV, or JSON into a structured, editable template in under a minute. | |
| Batch assessments | ☐ | ☑ | ☐ | ☑ | Sends the same questionnaire to an entire vendor group or list at once with a single due date. | |
| Magic-link passwordless vendor access | ☐ | ☑ | ☐ | ☑ | One-click vendor access to a questionnaire with no login or credential recovery required. | |
| Conditional logic branching | ☐ | ☑ | ☐ | ☑ | Shows or hides follow-up questions based on a vendor's earlier answers, so one template adapts per vendor. | |
| Audited-report autofill | ☐ | ☑ | ☐ | ☑ | Automatically completes questionnaire answers by pulling matching data from the vendor's own audited reports (e.g., SOC 2) already on file. | |
| AI Review Agent | ☐ | ☑ | ☐ | ☑ | Evaluates every submitted answer against policy, verifies attached evidence actually supports the claim, and extracts structured fields from documents, surfacing only exceptions for analyst review. | |
| Configurable risk score matrix | ☐ | ☑ | ☐ | ☑ | Produces an overall numeric risk score per assessment based on per-question point values. | |
| Cross-round remediation loop | ☐ | ☑ | ☐ | ☑ | Flags a failing answer, returns it to the vendor, and tracks the round-trip until resolved, accepted, or risk-acknowledged. | |
| Automated residual-risk reassessment campaigns | ☐ | ☑ | ☐ | ☑ | Automatically triggers reassessment questionnaires in batches to an entire vendor tier on a recurring cadence. | |
| One-screen questionnaire summary | ☐ | ☑ | ☐ | ☑ | Single view of pass/fail/unanswered counts, documents on file, contributors, and vendor activity for sign-off. | |
| Customer Trust | Evidence locker | ☑ | ☑ | ☑ | ☑ | A storage area where organizations post compliance documents and certifications for vendors and partners to review. You can keep each item private, share it publicly, or share it with specific organizations, and you can gate access behind an NDA workflow |
| Trust pages | Add-on | Add-on | Add-on | Add-on | Public page for centralizing evidence related to security, privacy, and compliance that customers or vendors can access during due diligence activities. | |
| Data rooms | Add-on | Add-on | Add-on | Add-on | Collaboration space where security teams can share files and policies with prospects and customers. | |
| AI-powered questionnaire response | Add-on | Add-on | Add-on | Add-on | Automated drafting of answers to security questionnaires by matching questions against stored compliance data and previous responses. | |
| Knowledge base | Add-on | Add-on | Add-on | Add-on | Source of truth for AI-powered questionnaire responses. Can be organized by different segments like product lines, business units, or regions. |
Driftnet: Internet Intelligence
Massive-scale infrastructure internet scanning engine that integrates high-fidelity scanning with industry leading attribution. The raw telemetry provided can be used to identify, hunt, and remediate threats across attack surfaces.
| CAPABILITY CATEGORY | CAPABILITY | INTRO | BASIC | STANDARD | UNLIMITED | DEFINITIONS |
| Internet Intelligence | Number of calls per year | 25,000 | 75,000 | 500,000 | Unlimited | Data feed that enables access to SecurityScorecard’s proprietary internet intelligence database. Data can be explored in a portal user interface and accessed directly via API. |
Services
These services are available as optional additions.
| CATEGORY | Product/Service | DEFINITIONS |
| TITAN MAX Managed Services | Questionnaires | Managed service for creating, distributing, and analyzing responses to vendor security questionnaires. One managed questionnaire per vendor per year. Requires a Premium or Elite license per vendor. |
| Monitor | Managed service for continuously monitoring third-party risks. Requires an Elite license per vendor. | |
| Respond | Managed service for continuously monitoring third-party risks and engaging vendors to drive risk awareness and issue resolution. Requires an Elite license per vendor. | |
| Onboarding | Onboarding | Structured services designed for accelerating the adoption of SecurityScorecard Platform capabilities. |