Not all risk types are returned by the Bitsight API. Access is controlled on a per-organization level (i.e., an organization must have the right subscriptions) and depends on the endpoint.
Bitsight risk types are grouped in the following manner:
Compromised Systems
The Compromised Systems risk category indicates the presence of malware or unwanted software, which is evidence of security controls failing to prevent malicious or unwanted software from running within an organization.
Name: Compromised Systems
Botnet Infections
The Botnet Infections risk vector indicates that devices on a company’s network are participating in a botnet (combination of “robot” and “network”), either as bots or as a command and control (C&C or C2) server.
Names:
Botnet Infectionsbotnet_infectionsbotnet
Spam Propagation
The Spam Propagation risk vector is composed of spambots, where a device on a company’s network is unsolicitedly sending commercial or bulk email (spam). If spam originates from email addresses or devices within a company’s network, this is an indication of an infection.
Names:
Spam Propagationspam_propagationspam
Malware Servers
The Malware Servers risk vector is an indication that a system is engaging in malicious activity, such as phishing, fraud, or scams. A company’s network is hosting malware that is meant to lure visitors to a website or send a file that injects malicious code or viruses.
Names:
Malware Serversmalware_serversmal_server
Unsolicited Communications
The Unsolicited Communications risk vector indicates a host is trying to contact a service on another host. It might be attempting to communicate with a server that is not providing or advertising any useful services, the attempt may be unexpected, or the service is unsupported. This also accounts for hosts that might be scanning darknets.
Names:
Unsolicited Communicationsunsolicited_communexp_comm
Potentially Exploited
The Potentially Exploited risk vector indicates that a device on a company’s network is running a potentially unwanted program (PUP) or potentially unwanted application (PUA).
Names:
Potentially Exploitedpotentially_exploitedpot_exploited
Diligence
The Diligence risk category assesses the steps a company has taken to prevent attacks, their best practice implementation, and risk mitigation (e.g., server configurations) to determine if the security practices of an organization are on par with industry-wide best practices.
Name: Diligence
SPF Domains
The SPF Domains risk vector assesses the effectiveness of Sender Policy Framework (SPF) records, which are DNS records that identify mail servers permitted to send email on behalf of a domain. Properly configured SPF records ensure that only authorized hosts can send email on behalf of a company by providing receiving mail servers the information they need to reject mail sent by unauthorized hosts.
Names:
SPFspf
DKIM Records
The DKIM Records risk vector assesses the effectiveness of DomainKeys Identified Mail (DKIM) records, which is a countermeasure against adversaries that are attempting to send fake email by using a company’s email domain. Properly configured DKIM records can ensure that only authorized hosts can send email on behalf of a company.
Names:
DKIMdkim
TLS/SSL Certificates
The TLS/SSL Certificates risk vector evaluates the strength and effectiveness of the cryptographic keys within TLS and SSL certificates, which are used to encrypt internet traffic. Certificates are responsible for verifying the authenticity of company servers to associates, clients, and guests, and also serves as the basis for establishing cryptographic trust.
Names:
SSL Certificatesssl_certificatescertificate
TLS/SSL Configurations
The TLS/SSL Configurations risk vector determines if the used security protocol libraries support strong encryption standards when making connections to other machines. TLS/SSL is a widely used method of securing communications over the Internet.
Names:
SSL Configurationsssl_configurationsssl
Open Ports
The Open Ports risk vector observes ports that are exposed to the Internet, known as “open ports.” While certain ports must be open to support normal business functions and few companies will actually have no ports open, the fewer ports that are exposed to the Internet, the fewer openings there are for attack.
Names:
Open Portsopen_portsopen_port
Web Application Security
The Web Application Security risk vector performs multiple assessments related to web application security. It provides information about components with known vulnerabilities, broken authentication and access control, sensitive data exposure, cross-site scripting prevention mechanisms, and security misconfigurations.
Names:
Web Application Securityweb_appsec
Patching Cadence
The Patching Cadence risk vector evaluates systems that are affected by software vulnerabilities (holes or bugs in software, hardware, or encryption methods that can be used by attackers to gain unauthorized access to systems and their data) and how quickly any issues are fixed.
Names:
Patching Cadencepatching_cadencepc
Insecure Systems
The Insecure Systems risk vector assesses endpoints (which can be any computer, server, device, system, or appliance with internet access) that are communicating with an unintended destination. The software of these endpoints may be outdated, tampered, or misconfigured. A system is classified as “insecure” when these endpoints try to communicate with a web domain that doesn’t yet exist or isn’t registered to anyone.
Names:
Insecure Systemsinsecure_systemsinsecure_sys
Server Software
The Server Software risk vector helps track security problems introduced by server software that is no longer supported. Supported software versions receive attention from the software development team and vendor when bugs or vulnerabilities are discovered.
Names:
Server Softwareserver_software
Desktop Software
The Desktop Software risk vector compares the version information of laptop and desktop software with the latest and currently available software versions to determine if the device software is supported or out-of-date.
Names:
Desktop Softwaredesktop_softwareendpoint_pc
Mobile Software
The Mobile Software risk vector compares the version information of mobile device operating systems and browsers with the latest and currently available software versions to determine if the device software is supported or out-of-date.
Names:
Mobile Softwaremobile_softwareendpoint_mobile
DNSSEC Records
The DNSSEC Records risk vector determines if a company is using the DNSSEC protocol, which is a public key encryption that authenticates DNS servers, and then assesses the effectiveness of its configuration. The DNSSEC protocol protects against DNS spoofing, which involves diverting traffic to an attacker’s computer, creating an opportunity for loss of confidentiality, data theft, etc.
Names:
DNSSECdnssec
Mobile Application Security
The Mobile Application Security risk vector analyzes the security aspects of an organization’s mobile application offerings that are publicly available in official marketplaces, such as the Apple App Store and Google Play.
Names:
Mobile Application Securitymobile_application_securitymobile_appsec
Web Application Headers
The Web Application Headers risk vector analyzes security-related fields in the header section of communications between users and an application. They contain information about the messages, determine how to receive messages, and how recipients should respond to a message.
Names:
Web Application Headersapplication_securityhttp_headers
DMARC
The DMARC risk vector determines whether domains have a Domain-based Message Authentication, Reporting and Conformance (DMARC) policy or not and evaluates how effective it is at ensuring only verified senders are able to use this domain for email.
Names:
DMARCdmarc
Domain Squatting
The Domain Squatting risk vector detects the presence of domains named similarly to those that are owned and trademarked by an organization. Detection for these types of domains is based on information provided by DNS queries.
User Behavior
The User Behavior risk category assesses employee activity, such as file sharing and password re-use.
Name: User Behavior
File Sharing
The File Sharing risk vector tracks the sharing of files, such as books, music, movies, TV shows, and applications. This includes files shared over the BitTorrent protocol or when observed on company infrastructure.
Names:
File Sharingfile_sharingtorrent
Exposed Credentials
The Exposed Credentials risk vector looks at verified breaches to indicate if the employees of a company had their information publicly disclosed and posted online as a result of a successful cyber attack on their company’s third parties.
Name: Exposed Credentials
Public Disclosures
The Public Disclosures risk category provides information related to possible incidents of undesirable access to a company’s data, including breaches, general security incidents, and other disclosures. Information is collected from verifiable news sources, both domestic and international, and by filing Freedom of Information Act (FOIA) requests.
Name: Public Disclosures
Security Incidents
The Security Incidents risk vector involves a broad range of events related to the undesirable access of a company’s data or resources, including personal health information, personally identifiable information, trade secrets, and intellectual property. They’re grouped into Breach Security Incidents and General Security Incidents.
Names:
Security Incidentsdata_breaches- Breach Security Incident =
breach - General Security Incident =
general
Other Disclosures
The Other Disclosures risk vector includes other kinds of publicly disclosed events. It’s considered to be the least severe among the Public Disclosures risk vectors.
Name: other
Vulnerability
Learn more about vulnerabilities.
Name: vulnerability
- July 10, 2025: Added Web Application Security; Added DMARC.
- April 14, 2025: Linked to vulnerability definition; Condensed to just the name listing.
-
August 31, 2022: Added
/v1/insights/rating_changesas a related path.
Feedback
0 comments
Please sign in to leave a comment.