# US 11,451,572 B2 · Online portal for improving cybersecurity risk scores > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,572 B2 - Document ID: US11451572B2 - Status: Granted - Kind: B2 - Application number: 16/833,365 - Filed: 2020-03-27 - Published: 2020-07-16 - Granted: 2022-09-20 - Earliest claimed: 2014-12-13 - Assignees: SecurityScorecard, Inc. - Applicants: SecurityScorecard, Inc. - Inventors: Aleksandr Yampolskiy; Rob Blackin; Alexander Heid; Samuel Kassoumeh - Web page: https://patentgrep.com/patent/US11451572B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06N 20/00: Machine learning - G06Q 10/0635: Risk analysis of enterprise or organisation activities - G06Q 10/06393: {Score-carding, benchmarking or key performance indicator [KPI] analysis} - H04L 43/065: related to network devices - H04L 61/25: of the same type - H04L 61/2503: Translation of Internet protocol [IP] addresses - H04L 61/4511: using domain name system [DNS] - H04L 61/5007: Internet protocol [IP] addresses - H04L 61/5076: Update or notification mechanisms, e.g. DynDNS - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1458: {Denial of Service} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04W 84/12: WLAN [Wireless Local Area Networks] - G06F 2221/034: Test or assess a computer or a system - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Determining an entity's cybersecurity risk and benchmarking that risk includes non-intrusively collecting one or more types of data associated with an entity. Embodiments further include calculating a security score for at least one of the one or more types of data based, at least in part, on processing of security information extracted from the at least one type of data, wherein the security information is indicative of a level of cybersecurity. Some embodiments also comprise assigning a weight to the calculated security score based on a correlation between the extracted security information and an overall security risk determined from analysis of one or more previously-breached entities in the same industry as the entity. Additional embodiments include calculating an overall cybersecurity risk score for the entity based, at least in part, on the calculated security score and the weight assigned to the calculated security score. ## Claims ### Claim 1 A method for quantifying a cybersecurity risk level of an entity, the method comprising: identifying, by one or more processors operating on one or more machines, parameters for quantifying the cybersecurity risk level of the entity, where the parameters comprise information identifying the entity; non-intrusively searching, based on the parameters, by the one or more processors operating on one or more machines, for data indicative of potential cybersecurity threats to the entity, wherein non-intrusively searching for data indicative of potential cybersecurity threats to the entity includes collecting non-intrusive data without obtaining permission to collect the non-intrusive data; calculating, by the one or more processors operating on one or more machines, a cybersecurity risk score for the entity based, at least in part, on the data indicative of cybersecurity threats to the entity; and presenting, by the one or more processors operating on one or more machines, data representative of the cybersecurity risk score and one or more actions to improve the cybersecurity risk score, where the one or more actions are based on the data indicative of potential cybersecurity threats to the entity. ### Claim 2 (depends on 1) The method of claim 1, further comprising: categorizing the entity according to the entity's size; and determining a cybersecurity ranking for the entity based, at least in part, on a benchmarking of the entity's cybersecurity risk score against at least one other entity's cybersecurity risk score, where the entity and the at least one other entity are in the same category according to their size. ### Claim 3 (depends on 1) The method of claim 1, further comprising: monitoring one or more sources of the data indicative of cybersecurity threats to the entity in real-time; and generating an alert based on changes to the cybersecurity risk score of the entity based on the monitoring. ### Claim 4 (depends on 3) The method of claim 3, further comprising predicting one or more breaches based on the monitoring. ### Claim 5 (depends on 1) The method of claim 1, further comprising initiating operations to intrusively search for a portion of the data indicative of cybersecurity threats to the entity. ### Claim 6 (depends on 1) The method of claim 1, further comprising normalizing the cybersecurity risk score based, at least in part, on the data indicative of cybersecurity threats to the entity and a size of the entity. ### Claim 7 (depends on 1) The method of claim 1, where the data indicative of cybersecurity threats to the entity comprises at least one type of data selected from the list consisting of: malware infections, breach history, domain name system (DNS) health, social media data, botnet infections, application vulnerabilities, network exploits, patching cadence, and leaked employee credentials. ### Claim 8 (depends on 1) The method of claim 1, wherein collecting non-intrusive data without obtaining permission to collect the non-intrusive data includes collecting non-intrusive data without obtaining permission from the entity for which the cybersecurity risk score is calculated. ### Claim 9 A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a computing system, cause the one or more processors to perform operations for quantifying a cybersecurity risk level of an entity, the operations comprising: identifying, by one or more processors, parameters for quantifying the cybersecurity risk level of the entity, where the parameters comprise information identifying the entity; non-intrusively searching, based on the parameters, by the one or more processors, for data indicative of potential cybersecurity threats to the entity, wherein non-intrusively searching for data indicative of potential cybersecurity threats to the entity includes collecting non-intrusive data without obtaining permission to collect the non-intrusive data; calculating, by the one or more processors, a cybersecurity risk score for the entity based, at least in part, on the data indicative of cybersecurity threats to the entity; and presenting, by the one or more processors, data representative of the cybersecurity risk score and one or more actions to improve the cybersecurity risk score, where the one or more actions are based on the data indicative of potential cybersecurity threats to the entity. ### Claim 10 (depends on 9) The non-transitory computer-readable medium of claim 9, where the operations further comprise: categorizing the entity according to the entity's size; and determining a cybersecurity ranking for the entity based, at least in part, on a benchmarking of the entity's cybersecurity risk score against at least one other entity's cybersecurity risk score, where the entity and the at least one other entity are in the same category according to their size. ### Claim 11 (depends on 9) The non-transitory computer-readable medium of claim 9, where the operations further comprise receiving information that identifies at least one action of the one or more actions that has been completed. ### Claim 12 (depends on 11) The non-transitory computer-readable medium of claim 11, where the operations further comprise: updating the cybersecurity risk score based on the information that identifies the at least one action that has been completed; normalizing the cybersecurity risk score, or both. ### Claim 13 (depends on 9) The non-transitory computer-readable medium of claim 9 where the operations further comprise initiating operations to intrusively search for a portion of the data indicative of cybersecurity threats to the entity. ### Claim 14 (depends on 9) The non-transitory computer-readable medium of claim 9, where the data indicative of cybersecurity threats to the entity comprise at least one type of data selected from the list consisting of: malware infections, breach history, domain name system (DNS) health, social media data, botnet infections, application vulnerabilities, network exploits, patching cadence, and leaked employee credentials. ### Claim 15 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein collecting non-intrusive data without obtaining permission to collect the non-intrusive data includes collecting non-intrusive data without obtaining permission from the entity for which the cybersecurity risk score is calculated. ### Claim 16 A system for quantifying a cybersecurity risk level of an entity, comprising: a memory; and one or more processors communicatively coupled to the memory, the one or more processors configured to: identify parameters for quantifying the cybersecurity risk level of the entity, where the parameters comprise information identifying the entity; non-intrusively search for data indicative of potential cybersecurity threats to the entity based on the parameters, wherein the configuration of the one or more processors to non-intrusively search for data indicative of potential cybersecurity threats to the entity includes configuration of the one or more processors to collect non-intrusive data without obtaining permission to collect the non-intrusive data; calculate a cybersecurity risk score for the entity based, at least in part, on the data indicative of cybersecurity threats to the entity; and present data representative of the cybersecurity risk score and one or more actions to improve the cybersecurity risk score, where the one or more actions are based on the data indicative of potential cybersecurity threats to the entity. ### Claim 17 (depends on 16) The system of claim 16, where the one or more processors are configured to: categorize the entity according to the entity's size; and determine a cybersecurity ranking for the entity based, at least in part, on a benchmarking of the entity's cybersecurity risk score against at least one other entity's cybersecurity risk score, where the entity and the at least one other entity are in the same category according to their size. ### Claim 18 (depends on 16) The system of claim 16, where the one or more processors are configured to determine: receiving information that identifies at least one action of the one or more actions that has been completed; and updating the cybersecurity risk score based on the information that identifies the at least one action that has been completed. ### Claim 19 (depends on 16) The system of claim 16, where the one or more processors are configured to: generate an interactive scorecard comprising scorecard information representative of the cybersecurity risk score for the entity, the scorecard information comprising: a list of primary factors affecting the cybersecurity risk level of the entity; and a list of secondary factors affecting the cybersecurity risk level of the entity; and presenting the interactive scorecard to a user via a user interface. ### Claim 20 (depends on 16) The system of claim 16, where at least a portion of the data indicative of cybersecurity threats to the entity is collected from publicly accessible data sources.