Topic starter
11/07/2026 8:31 pm
TL;DR: Portfolio comparisons get sharper when SecurityScorecard links breach susceptibility to posture data, footprint size, and claims history from more than 10,000 cyber insurance policies. Exposure scoring still needs control evidence, because underwriting and third-party risk decisions can be distorted if access paths are not visible.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “How to Measure a Company’s Cyber Risk with the Breach Susceptibility Indicator”.
Key questions
Q: Why can two organisations with similar security posture still have different breach risk?
A: Because breach likelihood depends on more than current control grades.
Q: What should teams do when a cyber risk score is based on probabilistic modelling?
A: Treat the score as a directional indicator and test it against real control evidence.
Q: How should security teams use breach susceptibility scores in practice?
A: Use them as prioritisation signals, not as proof of control failure or control success.
Practitioner guidance
- Review susceptibility scores alongside control evidence Use the score to prioritise review, but require direct proof of access controls, remediation history, and external exposure before changing underwriting or risk treatment.
- Validate vendor and third-party access paths Check whether third-party accounts, integrations, and externally reachable systems are inflating the organisation’s breach susceptibility through unmanaged trust paths.
- Incorporate NHI exposure into portfolio review Assess service accounts, API credentials, and other non-human identities as part of the digital footprint that feeds susceptibility scoring and breach likelihood.
Bottom line: Breach susceptibility scoring is best understood as a portfolio risk signal that complements, rather than replaces, control evidence.
Glossary terms: Breach Susceptibility Indicator, Online Footprint, Inherent risk, Third Party Risk
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
11/07/2026 9:00 pm
Susceptibility scoring is a governance input, not a control substitute. The article is useful because it acknowledges a real underwriting problem: security posture alone does not explain loss likelihood. But once a score starts shaping risk acceptance, pricing, or third-party prioritisation, teams must still demand control evidence for the underlying access paths, exposure, and identity lifecycle conditions that create the score in the first place.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do identity and third-party access affect breach susceptibility?
A: They expand the number of reachable paths into the environment. Broad vendor access, unmanaged service accounts, and exposed machine identities increase the likelihood that a threat actor can move from initial access to meaningful impact. That is why identity governance should be part of any susceptibility review, especially in supply chain-heavy environments.
👉 Read our full editorial: Breach susceptibility scoring is changing cyber risk underwriting