Not all risk types are returned by the Bitsight API. Access is controlled on a per-organization level (i.e., an organization must have the right subscriptions) and depends on the endpoint.
Bitsight risk types are grouped in the following manner:
Compromised Systems
The Compromised Systems risk category indicates the presence of malware or unwanted software, which is evidence of security controls failing to prevent malicious or unwanted software from running within an organization.
Name: Compromised Systems
Botnet Infections
The Botnet Infections risk vector indicates that devices on a company’s network are participating in a botnet (combination of “robot” and “network”), either as bots or as a command and control (C&C or C2) server.
Names:
Botnet Infections
botnet_infections
botnet
Spam Propagation
The Spam Propagation risk vector is composed of spambots, where a device on a company’s network is unsolicitedly sending commercial or bulk email (spam). If spam originates from email addresses or devices within a company’s network, this is an indication of an infection.
Names:
Spam Propagation
spam_propagation
spam
Malware Servers
The Malware Servers risk vector is an indication that a system is engaging in malicious activity, such as phishing, fraud, or scams. A company’s network is hosting malware that is meant to lure visitors to a website or send a file that injects malicious code or viruses.
Names:
Malware Servers
malware_servers
mal_server
Unsolicited Communications
The Unsolicited Communications risk vector indicates a host is trying to contact a service on another host. It might be attempting to communicate with a server that is not providing or advertising any useful services, the attempt may be unexpected, or the service is unsupported. This also accounts for hosts that might be scanning darknets.
Names:
Unsolicited Communications
unsolicited_comm
unexp_comm
Potentially Exploited
The Potentially Exploited risk vector indicates that a device on a company’s network is running a potentially unwanted program (PUP) or potentially unwanted application (PUA).
Names:
Potentially Exploited
potentially_exploited
pot_exploited
Diligence
The Diligence risk category assesses the steps a company has taken to prevent attacks, their best practice implementation, and risk mitigation (e.g., server configurations) to determine if the security practices of an organization are on par with industry-wide best practices.
Name: Diligence
SPF Domains
The SPF Domains risk vector assesses the effectiveness of Sender Policy Framework (SPF) records, which are DNS records that identify mail servers permitted to send email on behalf of a domain. Properly configured SPF records ensure that only authorized hosts can send email on behalf of a company by providing receiving mail servers the information they need to reject mail sent by unauthorized hosts.
Names:
SPF
spf
DKIM Records
The DKIM Records risk vector assesses the effectiveness of DomainKeys Identified Mail (DKIM) records, which is a countermeasure against adversaries that are attempting to send fake email by using a company’s email domain. Properly configured DKIM records can ensure that only authorized hosts can send email on behalf of a company.
Names:
DKIM
dkim
TLS/SSL Certificates
The TLS/SSL Certificates risk vector evaluates the strength and effectiveness of the cryptographic keys within TLS and SSL certificates, which are used to encrypt internet traffic. Certificates are responsible for verifying the authenticity of company servers to associates, clients, and guests, and also serves as the basis for establishing cryptographic trust.
Names:
SSL Certificates
ssl_certificates
certificate
TLS/SSL Configurations
The TLS/SSL Configurations risk vector determines if the used security protocol libraries support strong encryption standards when making connections to other machines. TLS/SSL is a widely used method of securing communications over the Internet.
Names:
SSL Configurations
ssl_configurations
ssl
Open Ports
The Open Ports risk vector observes ports that are exposed to the Internet, known as “open ports.” While certain ports must be open to support normal business functions and few companies will actually have no ports open, the fewer ports that are exposed to the Internet, the fewer openings there are for attack.
Names:
Open Ports
open_ports
open_port
Web Application Headers
The Web Application Headers risk vector analyzes security-related fields in the header section of communications between users and an application. They contain information about the messages, determine how to receive messages, and how recipients should respond to a message.
Names:
Web Application Headers
application_security
http_headers
Patching Cadence
The Patching Cadence risk vector evaluates systems that are affected by software vulnerabilities (holes or bugs in software, hardware, or encryption methods that can be used by attackers to gain unauthorized access to systems and their data) and how quickly any issues are fixed.
Names:
Patching Cadence
patching_cadence
pc
Insecure Systems
The Insecure Systems risk vector assesses endpoints (which can be any computer, server, device, system, or appliance with internet access) that are communicating with an unintended destination. The software of these endpoints may be outdated, tampered, or misconfigured. A system is classified as “insecure” when these endpoints try to communicate with a web domain that doesn’t yet exist or isn’t registered to anyone.
Names:
Insecure Systems
insecure_systems
insecure_sys
Server Software
The Server Software risk vector helps track security problems introduced by server software that is no longer supported. Supported software versions receive attention from the software development team and vendor when bugs or vulnerabilities are discovered.
Names:
Server Software
server_software
Desktop Software
The Desktop Software risk vector compares the version information of laptop and desktop software with the latest and currently available software versions to determine if the device software is supported or out-of-date.
Names:
Desktop Software
desktop_software
endpoint_pc
Mobile Software
The Mobile Software risk vector compares the version information of mobile device operating systems and browsers with the latest and currently available software versions to determine if the device software is supported or out-of-date.
Names:
Mobile Software
mobile_software
endpoint_mobile
DNSSEC Records
The DNSSEC Records risk vector determines if a company is using the DNSSEC protocol, which is a public key encryption that authenticates DNS servers, and then assesses the effectiveness of its configuration. The DNSSEC protocol protects against DNS spoofing, which involves diverting traffic to an attacker’s computer, creating an opportunity for loss of confidentiality, data theft, etc.
Names:
DNSSEC
dnssec
Mobile Application Security
The Mobile Application Security risk vector analyzes the security aspects of an organization’s mobile application offerings that are publicly available in official marketplaces, such as the Apple App Store and Google Play.
Names:
Mobile Application Security
mobile_application_security
mobile_appsec
Domain Squatting
The Domain Squatting risk vector detects the presence of domains named similarly to those that are owned and trademarked by an organization. Detection for these types of domains is based on information provided by DNS queries.
User Behavior
The User Behavior risk category assesses employee activity, such as file sharing and password re-use.
Name: User Behavior
File Sharing
The File Sharing risk vector tracks the sharing of files, such as books, music, movies, TV shows, and applications. This includes files shared over the BitTorrent protocol or when observed on company infrastructure.
Names:
File Sharing
file_sharing
torrent
Exposed Credentials
The Exposed Credentials risk vector looks at verified breaches to indicate if the employees of a company had their information publicly disclosed and posted online as a result of a successful cyber attack on their company’s third parties.
Name: Exposed Credentials
Public Disclosures
The Public Disclosures risk category provides information related to possible incidents of undesirable access to a company’s data, including breaches, general security incidents, and other disclosures. Information is collected from verifiable news sources, both domestic and international, and by filing Freedom of Information Act (FOIA) requests.
Name: Public Disclosures
Security Incidents
The Security Incidents risk vector involves a broad range of events related to the undesirable access of a company’s data or resources, including personal health information, personally identifiable information, trade secrets, and intellectual property. They’re grouped into Breach Security Incidents and General Security Incidents.
Names:
Security Incidents
data_breaches
- Breach Security Incident =
breach
- General Security Incident =
general
Other Disclosures
The Other Disclosures risk vector includes other kinds of publicly disclosed events. It’s considered to be the least severe among the Public Disclosures risk vectors.
Name: other
Vulnerability
Learn more about vulnerabilities.
Name: vulnerability
- April 14, 2025: Linked to vulnerability definition; Condensed to just the name listing.
-
August 31, 2022: Added
/v1/insights/rating_changes
as a related path. -
July 8, 2021: Added
/sovereign/observations
as a related path.
Feedback
0 comments
Please sign in to leave a comment.