Question 1

What is CyberRank?

Accepted Answer

CyberRank is an automated Third-Party / Vendor Risk Management (VRM) platform. It helps organisations assess, monitor, and manage the cyber security posture, privacy compliance, and data breach exposure of their vendors and partners on a continuous basis — powered by the IISRI® rating standard.

Question 2

How does CyberRank assess a vendor or organisation?

Accepted Answer

CyberRank combines AI analysis with non-intrusive automated scanners across four layers: Privacy Policy Assessment — in-depth analysis of the vendor's published privacy policy against 16 GDPR-aligned pillars, including cookie and consent banner testing. Security & Infrastructure Scan — SSL/TLS configuration and certificates, security headers, DNSSEC, DKIM, SPF, and Post-Quantum Cryptography (PQC) readiness across the main domain and discovered subdomains. Breach & Threat Intelligence — monitoring of public and verified data breach incidents and leaked credentials. Internal Questionnaires (optional) — custom internal assessments that blend external technical scores with the vendor's own compliance evidence.

Question 3

What is the IISRI® rating?

Accepted Answer

IISRI® (International Information Security Rating Index) is the standard behind every CyberRank score. It converts hundreds of technical and privacy signals into a single, comparable letter grade so you can benchmark vendors against each other and track their posture over time.

Question 4

Who is CyberRank built for?

Accepted Answer

Security and risk teams, compliance officers, DPOs, procurement teams, and executives who need defensible third-party risk evidence — for example to support DORA obligations, SEC disclosure readiness, ISO 27001 supplier controls, or local privacy regulations such as GDPR and Indonesia's UU PDP. Vendors themselves also use CyberRank to demonstrate their posture to customers.

Question 5

Is the scanning intrusive? Do I need the vendor's permission?

Accepted Answer

No. Directory and assessment scans are non-intrusive and only observe information that is already publicly exposed by the vendor's internet-facing services — the same way a customer or attacker would see it. No exploitation, brute-forcing, or authenticated testing is performed. Deeper capabilities such as the External Security Sensor do require explicit domain authorisation (consent) before activation.

Question 6

What do the AAA to D ratings and risk levels mean?

Accepted Answer

CyberRank uses a standardised 10-level rating scale, from AAA to D, that reflects a vendor's combined technical security posture and privacy compliance: AAA — None to Minimal risk: an exceptional security and privacy posture, with comprehensive controls and no detected vulnerabilities. AA — Very Low risk: a very strong security and privacy posture with negligible risk. A / BBB — Low risk: a good security and compliance posture that meets most industry expectations. BB / B — Moderate risk: an adequate posture, but with configuration gaps or privacy matters that should be addressed. CCC / CC — High risk: significant technical vulnerabilities or privacy-policy compliance gaps require follow-up. C — Very High risk: weak security configuration or incident history requires urgent mitigation. D — Almost Certain risk: a critical, highly vulnerable posture requiring emergency remediation before the business relationship continues.

Question 7

Which indicators are used to evaluate a privacy policy?

Accepted Answer

The AI privacy assessment scores 16 dimensions (A–P) of the published policy: A — Transparency of personal data collection B — Lawful basis for processing C — Purpose of data use D — Third-party data sharing E — Data retention and deletion F — Data subject rights (access, correction, portability, erasure) G — Opt-out and objection mechanisms H — Data security safeguards I — Cross-border data transfers J — Children's and special-category data protection K — Cookies and tracking technologies L — Data Protection Officer (DPO) contact details M — Breach notification procedures N — Automated decision-making and profiling O — Policy update mechanisms P — Language clarity and accessibility

Question 8

Does CyberRank assess subdomains, not just the main domain?

Accepted Answer

Yes — and this is one of the clearest differentiators against other rating providers, which typically score the primary domain only. When you assess an organisation, CyberRank automatically discovers its internet-facing estate and runs the full security assessment across dozens of hosts — more than 50 subdomains in a single assessment — so you see the vendor's real attack surface rather than just its homepage. Each discovered host is evaluated for: SSL/TLS configuration, cipher strength, and certificate validity or expiry. Configuration weaknesses, missing security headers, and known vulnerabilities. Leaked credentials associated with that host. Post-Quantum Cryptography readiness. Subdomains are ranked by traffic and popularity, so the hosts that matter most to your risk exposure surface first — forgotten staging servers, legacy portals, and shadow IT included. Have a larger estate? Enterprises and vendors with more than 50 subdomains can extend coverage further — additional subdomain scanning is available through extra credit allocation or a dedicated enterprise tier. Get in touch and we'll scope it with you.

Question 9

When should I run a reassessment?

Accepted Answer

You can re-run an assessment at any time to refresh a vendor's report. Common triggers: The vendor has updated its privacy policy, fixed a server configuration, or rotated its SSL certificate. The vendor has finished remediating findings from a previous report. Your team needs current audit evidence for a periodic review cycle.

Question 10

How do I claim my organisation's vendor profile?

Accepted Answer

If your organisation already appears in the CyberRank directory, you can claim the profile from its rating page. Once verified, you can update official documents, upload security certifications, respond to findings, and publish a verified profile that your own customers can review.

Question 11

How long does an assessment take?

Accepted Answer

Most assessments complete within minutes. Larger estates take longer because subdomain discovery, TLS testing, and AI privacy analysis all run across every host we find. You'll be notified when the report is ready, so you don't need to keep the page open.

Question 12

Why should I enable continuous monitoring?

Accepted Answer

Monitoring turns a one-off snapshot into an early-warning system: Daily or real-time email alerts for new data breaches, expiring or changed SSL certificates, and score drops. An automatically documented risk trend history for audits and regulatory reporting. No manual re-scanning — the vendor's rating stays current between review cycles.

Question 13

How does CyberRank verify a data breach?

Accepted Answer

Breach intelligence goes through a multi-tier curation model before it becomes a verified alert: Early detection of potential incidents across a broad set of public sources and commercial threat intelligence feeds. Automated cross-checking against established, independently maintained breach databases to confirm the incident and its scope. Confidence scoring, followed by manual curation by CyberRank security analysts before an alert is marked Verified.

Question 14

What is the Darknet Exposure Report?

Accepted Answer

It is an on-demand report showing where a domain's credentials, email addresses, or corporate data appear in dark web and underground marketplaces. It's typically used to quantify credential-stuffing and account-takeover exposure before onboarding a vendor or after a suspected incident.

Question 15

Can I create custom questionnaires for my vendors?

Accepted Answer

Yes. From the Questionnaires menu you can build a questionnaire from a template, group questions into sections or domains, send a public link to the vendor, and set an Impact percentage that determines how much the responses influence the vendor's combined rating.

Question 16

What's the difference between a Directory Assessment and an Individual Assessment?

Accepted Answer

Both use the same scanning engine, but they serve different purposes: Directory Assessment — a fast automated scan of a vendor's public domain, published to the shared CyberRank directory. Individual Assessment — a private, in-depth assessment inside your organisation's workspace, with owner/monitor assignment, evidence document uploads (SOC 2, ISO 27001, audit reports), and integrated questionnaires.

Question 17

Can I attach evidence documents such as SOC 2 or ISO 27001 reports?

Accepted Answer

Yes. Individual assessments let you upload supporting evidence — certifications, audit reports, DPAs, or terms and conditions — and keep it alongside the technical findings. Uploaded T&C and policy PDFs can additionally be analysed by the AI engine so the document is scored, not just stored.

Question 18

How does the team credit pool work?

Accepted Answer

Credits are held centrally per team or organisation rather than per user. Any member granted the Can Spend Credit permission may draw on the shared balance to run assessments, enable monitoring, or activate paid features — so billing stays consolidated and auditable.

Question 19

How many credits does each feature cost?

Accepted Answer

Standard credit rates on the platform (1 CR = 1 USD): One-off assessment report: 20 CR: Full scan and report for one vendor Schedule / redo assessment: 20 CR: Re-run or refresh an existing assessment T&C / PDF document analysis: 40 CR: Upload and AI-verify a T&C or policy document Annual vendor monitoring: 340 CR / year: Daily monitoring and alerts (~28 CR per month) Monthly vendor monitoring: 30 CR / month: Daily monitoring and alerts, billed monthly Darknet exposure report: 20 CR: Dark web exposure analysis External Security Sensor (ESS): 500 CR: Sensor integration, requires domain consent API subscription: 500 CR / month: Full REST API access Rates are indicative and may be updated as the platform evolves — the Billing page in the platform always shows the current price before you confirm an action.

Question 20

How do I top up credits or redeem a voucher?

Accepted Answer

Two options, both instant: Buy credits — open the Billing page or the Buy Credits button in the platform header. Payments are processed securely through Stripe Checkout (international credit and debit cards). For larger bundles we can also issue a manual invoice with 30-day terms. Redeem a voucher — open Claim Credits and enter your promotional or welcome-credit code to add the balance to your team immediately.

Question 21

Do credits expire, and can I get a refund?

Accepted Answer

Credits are valid for 12 months from the date of purchase and can be spent on any service on the platform. Purchased credits are non-refundable, but they are flexible — there are no fixed tiers, no seats, and no commitment, so you only buy the amount you actually need.

Question 22

What is the External Security Sensor (ESS)?

Accepted Answer

The ESS is a security sensor module deployed against your infrastructure to run continuous scanning from an external perimeter perspective, going deeper than a standard directory scan. Because it performs active testing, activation requires explicit domain ownership authorisation (consent) before any scanning begins.

Question 23

Does CyberRank offer an API and webhooks?

Accepted Answer

Yes. From the API menu your organisation can issue API tokens to: Trigger assessments and pull ratings programmatically through the REST API. Configure webhooks with signature or header authentication to receive push events when a new vendor alert is raised. Feed CyberRank data into your existing GRC, SIEM, or procurement dashboards.

Question 24

What is the Post-Quantum Cryptography (PQC) readiness scan?

Accepted Answer

The PQC scan analyses the encryption algorithms, cipher suites, and certificates a server negotiates to determine whether its transport security is ready for the quantum era. You can try it on your own domain for free from our Post-Quantum Cryptography Assessment page — no sign-up required.

Question 25

How do I invite colleagues to my team?

Accepted Answer

Organisation admins can open Teams → Invite Member, enter a colleague's email address, and set their permissions — Admin, Member, or Viewer — plus the Can Spend Credit toggle that controls access to the shared credit balance.

Question 26

How do I secure my CyberRank account?

Accepted Answer

Enable multi-factor authentication (TOTP) from your account security settings using any standard authenticator app. We recommend MFA for every admin, and reviewing team membership and permissions whenever someone changes role or leaves the organisation.

Question 27

What if I hit a problem or have a technical question?

Accepted Answer

Logged-in users can open the Support page in the platform and raise a ticket, choosing the type that fits: Question — general or feature questions. Bug — something in the system is not working as expected. Issue — operational or data problems. Suggestion — ideas for new features.

Frequently Asked Questions

Still have questions?

Frequently Asked Questions

GeneralWhat is CyberRank?

GeneralHow does CyberRank assess a vendor or organisation?

GeneralWhat is the IISRI® rating?

GeneralWho is CyberRank built for?

GeneralIs the scanning intrusive? Do I need the vendor's permission?

Assessments & ScoringWhat do the AAA to D ratings and risk levels mean?

Assessments & ScoringWhich indicators are used to evaluate a privacy policy?

Assessments & ScoringDoes CyberRank assess subdomains, not just the main domain?

Assessments & ScoringWhen should I run a reassessment?

Assessments & ScoringHow do I claim my organisation's vendor profile?

Assessments & ScoringHow long does an assessment take?

Monitoring & AlertsWhy should I enable continuous monitoring?

Monitoring & AlertsHow does CyberRank verify a data breach?

Monitoring & AlertsWhat is the Darknet Exposure Report?

QuestionnairesCan I create custom questionnaires for my vendors?

QuestionnairesWhat's the difference between a Directory Assessment and an Individual Assessment?

QuestionnairesCan I attach evidence documents such as SOC 2 or ISO 27001 reports?

Credits & BillingHow does the team credit pool work?

Credits & BillingHow many credits does each feature cost?

Credits & BillingHow do I top up credits or redeem a voucher?

Credits & BillingDo credits expire, and can I get a refund?

API & SensorsWhat is the External Security Sensor (ESS)?

API & SensorsDoes CyberRank offer an API and webhooks?

API & SensorsWhat is the Post-Quantum Cryptography (PQC) readiness scan?

Account & SupportHow do I invite colleagues to my team?

Account & SupportHow do I secure my CyberRank account?

Account & SupportWhat if I hit a problem or have a technical question?

Still have questions?