Understand the Ransomware score

The Ransomware Score shows how closely a company's externally observable security posture resembles that of companies that later became ransomware victims. Use it to understand your exposure to ransomware and to decide which issues to fix first.

How it works

The Ransomware Score is a number from 0 to 100 plus a likelihood category. Lower is better.

A machine-learning model calculates the score. The model is trained on ransomware incidents and SecurityScorecard issue findings. It is separate from the Security Score and the Breach Susceptibility Indicator (BSI) models.

The model learns from companies named as victims on ransomware leak sites and in SecurityScorecard's breach records. It assumes an attack happened about four months before it was made public. SecurityScorecard recalculates the score daily from the latest findings.

The score is not a probability. A score of 56 does not mean a 56% chance of an attack. The score ranks companies against each other, so use the categories to decide what to act on.

Understand the categories

Each score falls into one of five categories. The Ransomware Score does not use letter grades.

A High or Very High rating does not mean an attack is imminent. It means the company's issue profile closely matches the profiles of companies that were later attacked.

Review how the score performs

Companies rated Low or above were about 3 times as likely to appear on a ransomware leak site as companies rated Very Low. This comparison uses categories assigned in November 2025 and leak-site victims posted from December 2025 to October 2026.

Review what the score considers

The score uses the 50 SecurityScorecard issue types that are most predictive of ransomware, selected from 123 tested. It looks at findings from the last 90 days or so: their severity relative to similar companies, how much they vary, and how often and how recently they spike. It also considers the size of the company's digital footprint (IPs and domains).

The issue types fall into these families:

• TLS and certificates: weak ciphers and protocols; self-signed, expired, or long-lived certificates; missing revocation checks.
• Patching cadence and vulnerabilities: unpatched software at medium, high, and critical severity; known exploitable services.
• Exposed services: open ports, proxies, remote-access protocols, mail and DNS services, and IoT devices.
• Web application security: missing or weak security headers, insecure cookies, and insecure redirects and forms.
• Email and domain security: missing or misconfigured SPF records and typosquat domains.
• Other signals: outdated browsers and exposed personal information.

To see which issues drive a specific company's score, open the Ransomware Analytics report. It lists the top contributing issues for that company.

Compare the Ransomware Score to other metrics

A company can have a good Security Score and still rate High for ransomware. The two scores weigh issues differently, and the Ransomware Score focuses on the issues most associated with ransomware attacks.

Where to see an organization's Ransomware Score

You can view an organization’s Ransomware Score in the following areas of the platform:

• Ransomware Analytics report: Go to Automation > Reporting Center > Ransomware Analytics to see the score alongside the issue types that affect it.
• Scorecard overview: The Ransomware Score widget shows the score for the scorecard you are viewing, based on the likelihood of being ransomed. Select View Ransomware Analytics in the widget to open the Ransomware Analytics report for that scorecard.
• Portfolios: Add the Ransomware Score column to the portfolio companies table to compare scores across the companies in a portfolio. You can also filter the table by Ransomware Score category.
• Vendor System of Record: The Ransomware Score column in the companies list shows each company's score. You can filter the list by Ransomware Score category.
• Company comparison: The Ransomware Score row compares scores across the companies you select, and a history chart shows how each score has changed over time.
• Custom Risk Report: The Ransomware Score column shows the score for each company included in the report.

If you don't see a Ransomware Score, there may not be enough data about the organization to calculate one.

Improve your Ransomware Score

Fix the issues that contribute most to the score, and keep them fixed.

1. Open the Ransomware Analytics report (Automation > Reporting Center) to see the top contributing issues.
2. Start with the issues the report ranks highest. The score is directional, so use it to set priorities rather than as an issue-by-issue checklist.
3. Expect gradual change. The score looks at the last 90 days or so, so a fix lowers the score over the following weeks rather than overnight. Sustained improvement matters more than a one-time cleanup.

A company's past ransomware incidents don't affect its score. Only current issue findings and footprint size do.

Review limitations

• Relative, not a forecast: The score compares companies with each other. It has no fixed time horizon and does not predict when an attack will happen.
• Slow to reflect fixes: The 90-day window keeps recently fixed issues in the calculation for a while.
• Outside-in only: The model sees only externally observable findings, not internal controls such as backups, EDR, or staff training.
• Leak sites undercount victims: Victims who pay quietly never appear on leak sites, so the model observes a lower attack rate than reality.
• Footprint size is an input: Unlike the Security Score, this score is not adjusted for company size. Larger footprints offer more exposure.
• Daily updates without smoothing: Small day-to-day moves are normal. Companies with few observable findings have less reliable scores.