Bitsight for Security Performance Management

My main use case for Bitsight  involves multiple reasons; I used it primarily for continuous vendor risk visibility, and I did not want to rely on annual questionnaires. Vendor onboarding risk assessment, continuous third-party monitoring, and high-risk vendor prioritization capability were essential, as I reported this back to the board and used it for executive dashboarding.

A specific example of how I used Bitsight  for vendor risk visibility and prioritization is that it serves as an external cyber risk rating platform or a cybersecurity posture platform that provides outside-in visibility of an organization and third parties. I utilized the features for my third-party risk management framework, conducting attack surface understanding and visibility for third parties. It helped me with continuous monitoring and executive reporting. I view this as a continuous cyber risk intelligence layer that can be used for vendors and helps monitor enterprise risk exposure.

Regarding my main use case, I have nothing specific to add, except for the fact that I did not construe Bitsight as a vulnerability management tool or a scanner, which many organizations use this for. In order to manage the external exposure to the organization, wherein I could manage the domains, IPs, and cloud footprint of third-party service providers, it really helped me in conducting due diligence for potential partners and service providers, and it really supported the organization in merger and acquisition strategy.

The best features Bitsight offers include security ratings, also known as cyber score, which helps me do continuous monitoring. I can run this tool for a large number of high-risk vendors, enabling vendor benchmarking. External attack surface visibility is another feature that I used comprehensively, and third-party ecosystem monitoring provides that visibility. Finally, executive reporting dashboards sum everything up.

Among the features including security ratings, attack surface visibility, and executive reporting, scalability is what made the biggest difference for my team's day-to-day work. My colleagues responded positively to the continuous monitoring provided by Bitsight, enabling us to do vendor comparisons and benchmarking, leading to very good executive-friendly risk visualization.

Bitsight has positively impacted the organization by helping with vendor benchmarking and providing outside-in cyber visibility across hundreds of vendors, which is the biggest plus.

The impact includes more contextual prioritization, which is the biggest business benefit I gained. Reporting  to the board, getting dashboards, visibility, and analytics is absolutely fine, but contextual prioritization allows me to assess which vendor has the largest exposure and where I need to be more careful, what kind of remediation activities need to be implemented, and this led to faster remediation visibility improvements with the vendor community.

There are opportunities for improvement in Bitsight. Better explainability of cyber scores is something that Bitsight can work upon, along with addressing false positives. Better cloud-native visibility to identify where service providers might be exposed, and further enhancements in predictive risk and analytics are areas that can be developed.

I covered the main points about needed improvements, emphasizing that everything else is operational and not a limitation on Bitsight's usage.

I would rate Bitsight closer to nine, or somewhere between eight and nine, because the reasons I do not rate it a ten relate to opportunities for improvement I mentioned, such as broader risk, cyber risk intelligence, and emphasis on supply chain risk intelligence. There is potential for improvement in AI-assisted prioritization as it matures.

I choose eight as my official rating of Bitsight.

I chose eight as my rating for Bitsight because it needs to move in the direction of providing broader risk, cyber risk analysis, working more on supply chain risk intelligence, and using AI for prioritization further. I talked about areas of improvement concerning predictive risk analysis, reduction of false positives, and better explainability of the scores, which justifies my rating as eight rather than ten.

Regarding Bitsight's AI capabilities, I am not very sure about the governance and security aspects of AI that Bitsight uses, as I am not aware of any policies they may have regarding AI usage for their services. However, I think AI should be used much more strongly to enhance predictive analysis by Bitsight.

The accuracy and reliability of Bitsight's output stem from its capability of using AI effectively. AI relies on a lot of data from continuous monitoring, enabling faster risk triaging based on the outcomes generated by the AI engine. I believe it is a highly reliable outcome, and the platform has a mature rating system, provides good benchmarks, and has strong enterprise acceptance, so the outcome from the AI engine is quite reliable but can be further improved for predictive assessments.

I have been using Bitsight for over four years, precisely four and a half years, and I have actually used this at Nissan Motor Corporation, where I was the Global Deputy  Chief Information Security Officer.

Bitsight is stable in my experience; I have not faced any significant downtime or reliability issues, aside from some minor occurrences. It is highly reliable, scalable, and always available.

Bitsight's scalability is impressive; it handles increasing workloads and more vendors easily. I found that its scalable third-party risk assessment operating model is not merely a scorecard dashboard but a comprehensive assessment tool.

The customer support for Bitsight is responsive and helpful.

I would rate Bitsight's customer support a nine on a scale of one to ten.

Nine is my rating for Bitsight's customer support.

I did not use any other solution before Bitsight, although I can mention that I conducted POCs with two solutions, SecurityScorecard  and RiskRecon , before choosing Bitsight.

I see a return on investment with Bitsight clearly, as it becomes evident when I monitor hundreds or even thousands of vendors and replace traditional assessments with continuous monitoring. The ROI appears due to the reduction in manual risk efforts, as I have continuous monitoring instead of periodic assessments, with visibility into third-party cyber posture. Specific examples include a percentage reduction in manual vendor reviews, leading to substantial time savings during onboarding.

My experience with Bitsight's pricing, setup cost, and licensing reflects strong enterprise acceptance; I did not opt for only a one-year annuity-based contract but a multi-year one that was based on the number of IPs, providing great discounts.

I evaluated SecurityScorecard  and RiskRecon  before deciding on Bitsight.

I think I have mentioned the features comprehensively. I do not think anything else is left unsaid; I talked about continuous monitoring, benchmarking, dashboards, and attack surface visibility, along with security ratings and security scores.

My advice for others considering Bitsight is that for enterprises with a sizable third-party ecosystem, it is valuable for continuous cyber risk monitoring and understanding external posture, providing visibility. It should be part of a broader third-party risk assessment strategy, aiding decision-making, especially for organizations managing numerous vendors and supply chains with significant dependency. I recommend Bitsight for continuous monitoring of cyber risk at scale, as its value increases significantly with vendor complexity and organizational maturity.

I believe I have mentioned the necessary improvements comprehensively, which include better explainability of scores, contextual prioritization using AI, reduced false positives, and more predictive risk analysis. My overall rating for Bitsight is eight out of ten.

Hybrid Cloud

Amazon Web Services  (AWS )

What do you like best about the product?

It finds our public facing security flaws, gives as much info as it has on each finding, and exactly how to fix it.

What do you dislike about the product?

Almost nothing to dislike. The free offering is more than fair but to really use it, it'll cost you.

What problems is the product solving and how is that benefiting you?

Improves our cybersecurity position, helps our public image regarding the integrity of the company, and help the company prepare for security auditing required for certified compliance.

What do you like best about the product?

The marketing and positioning are polished. On the surface, Bitsight Threat Intelligence (formerly Cybersixgill) appears to offer broad dark web coverage and an impressive volume of data sources. The promise of automated threat discovery across forums, marketplaces, and paste sites is appealing, especially for teams that lack in-house collection capabilities.

Unfortunately, that promise rarely translates into day-to-day value.

What do you dislike about the product?

The biggest issue is signal-to-noise ratio. The platform generates a high volume of alerts and findings, but a significant portion are low-quality, redundant, or irrelevant. Analysts spend far too much time filtering noise instead of responding to actionable threats.

Performance is another major drawback. Searches and dashboards are often slow, which is frustrating for a tool that claims near real-time intelligence. The UI feels dated and clunky, and workflows are not intuitive.

Support and documentation also fall short of expectations for a product at this price point. Documentation is thin, and support responses are not too helpful.

What problems is the product solving and how is that benefiting you?

In theory, it is meant to solve early detection of credential leaks, brand abuse, and underground chatter before issues escalate. In practice, the benefit is limited because the data requires extensive manual triage to determine what actually matters.

Instead of accelerating response, it often adds operational overhead. The tool identifies “things that exist on the internet,” but stops short of consistently answering the more important question: what requires action right now?

What do you like best about the product?

Attack surface monitoring, security ratings and descriptive analysis.

What do you dislike about the product?

Mitigating the risks in time to improve the score.

What problems is the product solving and how is that benefiting you?

It is helping to identify the risks with open ports, risk vendors and thus helps us to mitigate the risks and improve security rating.