API Fields: Risk Types Ingrid Not all risk types are returned by the Bitsight API. Access is controlled on a per-organization level (i.e., an organization must have the right subscriptions) and depends on the endpoint. Bitsight risk types are grouped in the following manner: Compromised Systems Botnet Infections Spam Propagation Malware Servers Unsolicited Communications Potentially Exploited Diligence SPF Domains DKIM Records TLS/SSL Certificates TLS/SSL Configurations Open Ports Web Application Security Patching Cadence Insecure Systems Server Software Desktop Software Mobile Software DNSSEC Records Mobile Application Security Web Application Headers DMARC Domain Squatting User Behavior File Sharing Exposed Credentials Public Disclosures Security Incidents Other Disclosures Vulnerability Compromised Systems The Compromised Systems risk category indicates the presence of malware or unwanted software, which is evidence of security controls failing to prevent malicious or unwanted software from running within an organization. Name: Compromised Systems Botnet Infections The Botnet Infections risk vector indicates that devices on a company’s network are participating in a botnet (combination of “robot” and “network”), either as bots or as a command and control (C&C or C2) server. Names: Botnet Infections botnet_infections botnet Spam Propagation The Spam Propagation risk vector is composed of spambots, where a device on a company’s network is unsolicitedly sending commercial or bulk email (spam). If spam originates from email addresses or devices within a company’s network, this is an indication of an infection. Names: Spam Propagation spam_propagation spam Malware Servers The Malware Servers risk vector is an indication that a system is engaging in malicious activity, such as phishing, fraud, or scams. A company’s network is hosting malware that is meant to lure visitors to a website or send a file that injects malicious code or viruses. Names: Malware Servers malware_servers mal_server Unsolicited Communications The Unsolicited Communications risk vector indicates a host is trying to contact a service on another host. It might be attempting to communicate with a server that is not providing or advertising any useful services, the attempt may be unexpected, or the service is unsupported. This also accounts for hosts that might be scanning darknets. Names: Unsolicited Communications unsolicited_comm unexp_comm Potentially Exploited The Potentially Exploited risk vector indicates that a device on a company’s network is running a potentially unwanted program (PUP) or potentially unwanted application (PUA). Names: Potentially Exploited potentially_exploited pot_exploited Diligence The Diligence risk category assesses the steps a company has taken to prevent attacks, their best practice implementation, and risk mitigation (e.g., server configurations) to determine if the security practices of an organization are on par with industry-wide best practices. Name: Diligence SPF Domains The SPF Domains risk vector assesses the effectiveness of Sender Policy Framework (SPF) records, which are DNS records that identify mail servers permitted to send email on behalf of a domain. Properly configured SPF records ensure that only authorized hosts can send email on behalf of a company by providing receiving mail servers the information they need to reject mail sent by unauthorized hosts. Names: SPF spf DKIM Records The DKIM Records risk vector assesses the effectiveness of DomainKeys Identified Mail (DKIM) records, which is a countermeasure against adversaries that are attempting to send fake email by using a company’s email domain. Properly configured DKIM records can ensure that only authorized hosts can send email on behalf of a company. Names: DKIM dkim TLS/SSL Certificates The TLS/SSL Certificates risk vector evaluates the strength and effectiveness of the cryptographic keys within TLS and SSL certificates, which are used to encrypt internet traffic. Certificates are responsible for verifying the authenticity of company servers to associates, clients, and guests, and also serves as the basis for establishing cryptographic trust. Names: SSL Certificates ssl_certificates certificate TLS/SSL Configurations The TLS/SSL Configurations risk vector determines if the used security protocol libraries support strong encryption standards when making connections to other machines. TLS/SSL is a widely used method of securing communications over the Internet. Names: SSL Configurations ssl_configurations ssl Open Ports The Open Ports risk vector observes ports that are exposed to the Internet, known as “open ports.” While certain ports must be open to support normal business functions and few companies will actually have no ports open, the fewer ports that are exposed to the Internet, the fewer openings there are for attack. Names: Open Ports open_ports open_port Web Application Security The Web Application Security risk vector performs multiple assessments related to web application security. It provides information about components with known vulnerabilities, broken authentication and access control, sensitive data exposure, cross-site scripting prevention mechanisms, and security misconfigurations. Names: Web Application Security web_appsec Patching Cadence The Patching Cadence risk vector evaluates systems that are affected by software vulnerabilities (holes or bugs in software, hardware, or encryption methods that can be used by attackers to gain unauthorized access to systems and their data) and how quickly any issues are fixed. Names: Patching Cadence patching_cadence pc Insecure Systems The Insecure Systems risk vector assesses endpoints (which can be any computer, server, device, system, or appliance with internet access) that are communicating with an unintended destination. The software of these endpoints may be outdated, tampered, or misconfigured. A system is classified as “insecure” when these endpoints try to communicate with a web domain that doesn’t yet exist or isn’t registered to anyone. Names: Insecure Systems insecure_systems insecure_sys Server Software The Server Software risk vector helps track security problems introduced by server software that is no longer supported. Supported software versions receive attention from the software development team and vendor when bugs or vulnerabilities are discovered. Names: Server Software server_software Desktop Software The Desktop Software risk vector compares the version information of laptop and desktop software with the latest and currently available software versions to determine if the device software is supported or out-of-date. Names: Desktop Software desktop_software endpoint_pc Mobile Software The Mobile Software risk vector compares the version information of mobile device operating systems and browsers with the latest and currently available software versions to determine if the device software is supported or out-of-date. Names: Mobile Software mobile_software endpoint_mobile DNSSEC Records The DNSSEC Records risk vector determines if a company is using the DNSSEC protocol, which is a public key encryption that authenticates DNS servers, and then assesses the effectiveness of its configuration. The DNSSEC protocol protects against DNS spoofing, which involves diverting traffic to an attacker’s computer, creating an opportunity for loss of confidentiality, data theft, etc. Names: DNSSEC dnssec Mobile Application Security The Mobile Application Security risk vector analyzes the security aspects of an organization’s mobile application offerings that are publicly available in official marketplaces, such as the Apple App Store and Google Play. Names: Mobile Application Security mobile_application_security mobile_appsec Web Application Headers The Web Application Headers risk vector analyzes security-related fields in the header section of communications between users and an application. They contain information about the messages, determine how to receive messages, and how recipients should respond to a message. Names: Web Application Headers application_security http_headers DMARC The DMARC risk vector determines whether domains have a Domain-based Message Authentication, Reporting and Conformance (DMARC) policy or not and evaluates how effective it is at ensuring only verified senders are able to use this domain for email. Names: DMARC dmarc Domain Squatting The Domain Squatting risk vector detects the presence of domains named similarly to those that are owned and trademarked by an organization. Detection for these types of domains is based on information provided by DNS queries. User Behavior The User Behavior risk category assesses employee activity, such as file sharing and password re-use. Name: User Behavior File Sharing The File Sharing risk vector tracks the sharing of files, such as books, music, movies, TV shows, and applications. This includes files shared over the BitTorrent protocol or when observed on company infrastructure. Names: File Sharing file_sharing torrent Exposed Credentials The Exposed Credentials risk vector looks at verified breaches to indicate if the employees of a company had their information publicly disclosed and posted online as a result of a successful cyber attack on their company’s third parties. Name: Exposed Credentials Public Disclosures The Public Disclosures risk category provides information related to possible incidents of undesirable access to a company’s data, including breaches, general security incidents, and other disclosures. Information is collected from verifiable news sources, both domestic and international, and by filing Freedom of Information Act (FOIA) requests. Name: Public Disclosures Security Incidents The Security Incidents risk vector involves a broad range of events related to the undesirable access of a company’s data or resources, including personal health information, personally identifiable information, trade secrets, and intellectual property. They’re grouped into Breach Security Incidents and General Security Incidents. Names: Security Incidents data_breaches Breach Security Incident = breach General Security Incident = general Other Disclosures The Other Disclosures risk vector includes other kinds of publicly disclosed events. It’s considered to be the least severe among the Public Disclosures risk vectors. Name: other Vulnerability Learn more about vulnerabilities. Name: vulnerability July 10, 2025: Added Web Application Security; Added DMARC. April 14, 2025: Linked to vulnerability definition; Condensed to just the name listing. August 31, 2022: Added /v1/insights/rating_changes as a related path. Related articles GET: Finding Details GET: Detailed Company Observations GET: National Cybersecurity Observation Details by Risk Type Parameters API Fields: Vulnerability Status Feedback 0 comments Please sign in to leave a comment.