Ratings transparency
Cyber Posture Rating Explained
How Panorays non-intrusively evaluates your company’s and your third parties’ attack surface: hundreds of tests, rolled into one rating from 0 to 100.
Panorays evaluates attack surfaces by performing hundreds of tests and generates a rating from 0 to 100 that represents the risk of the external digital perimeter. Combined with questionnaire results and business context, it gives a full picture of supplier risk.
01 · Assessment
External Attack Surface Assessment
Panorays evaluates each company’s attack surface through externally available data, across three layers.
Asset discovery
Publicly accessible assets are identified automatically, usually starting from the primary domain.
Continuous monitoring
Initial assessments finish within hours; ratings update as the external footprint changes.
Non-intrusive
Assessed externally, without company engagement, from public sources and common probes like email verification.
02 · Methodology
Cyber Posture Rating Methodology
Hundreds of Tests run against a company’s assets. Each Test produces findings and a Test rating; Test ratings roll up into the final company rating.
Test examples
- Mail server SPF record present
- Deprecated SSL protocol supported
- Assets flagged for malicious activity
How a Test is rated
97%
of companies lack DNSSEC
1.7/100
average DNSSEC Test rating
Tests are built from industry best practices (OWASP, NIST) and researcher expertise, then run in hidden mode across tens of thousands of companies before release. Low adoption like DNSSEC’s is why a Test’s weight gets adjusted.
Challenging false positives
Invite
The supplier is invited to review its findings.
Dispute
The supplier submits a dispute with comments.
Validate
Panorays validates within 24 hours and updates the rating.
Summary
What the Rating Delivers
FAQ
Frequently Asked Questions
Does Panorays assess internal company assets?
No. The assessment is external and non-intrusive, performed without company engagement or access to internal resources.
Does Panorays run active penetration tests?
No. The assessment is completely external and doesn’t run active pentests like exploits or brute forcing. It still identifies vulnerabilities non-intrusively, with CVE correlation and bug bounty data.
What are the benefits of non-intrusive assessment vs. penetration tests?
Speed and scale (no installation, results within hours), breadth (all public-facing assets) and a continuous view with real-time alerts, where pentests go stale within days.
How does Panorays compare to vulnerability scanners?
Vulnerability scanners run intrusive tests on pre-defined assets and need consent. Panorays assessments are much more comprehensive and don’t require consent.