Topic starter
11/07/2026 8:31 pm
TL;DR: Breach susceptibility can be estimated across portfolios using posture data, footprint size, and insurance claims history from more than 10,000 cyber insurance policies, according to SecurityScorecard. The bigger shift is that underwriting and third-party risk teams now need to treat exposure scoring as a governance input, not a substitute for control evidence, with validation from Marsh McLennan CRIC.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “How to Measure a Company’s Cyber Risk with the Breach Susceptibility Indicator”.
Key questions
Q: How should security teams use breach susceptibility scores in practice?
A: Use them as prioritisation signals, not as proof of control failure or control success.
Q: Why can two organisations with similar security posture still have different breach risk?
A: Because breach likelihood depends on more than current control grades.
Q: What should teams do when a cyber risk score is based on probabilistic modelling?
A: Treat the score as a directional indicator and test it against real control evidence.
Practitioner guidance
- Review susceptibility scores alongside control evidence Use the score to prioritise review, but require direct proof of access controls, remediation history, and external exposure before changing underwriting or risk treatment.
- Validate vendor and third-party access paths Check whether third-party accounts, integrations, and externally reachable systems are inflating the organisation’s breach susceptibility through unmanaged trust paths.
- Incorporate NHI exposure into portfolio review Assess service accounts, API credentials, and other non-human identities as part of the digital footprint that feeds susceptibility scoring and breach likelihood.
Bottom line: Breach susceptibility scoring is best understood as a portfolio risk signal that complements, rather than replaces, control evidence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:00 pm
Susceptibility scoring is a governance input, not a control substitute. The article is useful because it acknowledges a real underwriting problem: security posture alone does not explain loss likelihood. But once a score starts shaping risk acceptance, pricing, or third-party prioritisation, teams must still demand control evidence for the underlying access paths, exposure, and identity lifecycle conditions that create the score in the first place.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do identity and third-party access affect breach susceptibility?
A: They expand the number of reachable paths into the environment. Broad vendor access, unmanaged service accounts, and exposed machine identities increase the likelihood that a threat actor can move from initial access to meaningful impact. That is why identity governance should be part of any susceptibility review, especially in supply chain-heavy environments.
👉 Read our full editorial: Breach susceptibility scoring is changing cyber risk underwriting