Information technology security assessment system

A system comprising:

• one or more computers programmed to perform operations comprising:
• collecting, from two or more sources, information corresponding to an entity, the information collected about the entity being indicative of (i) vulnerabilities of computing systems of the entity and (ii) resiliencies of the entity to recover from the vulnerabilities, wherein the information is indicative of durations of events associated with the vulnerabilities, wherein one or more of the sources is not controlled by the entity, wherein the information from at least the one or more sources that are not controlled by the entity is collected without permission of the entity;
• processing the information to form a composite security rating of the entity that is indicative of a degree of cybersecurity risk to (i) the entity or (ii) a third-party entity having a relationship with the entity, the composite security rating comprising a combination of security features extracted from the information, wherein the security features are indicative of (i) a measure of an extent of, a frequency of, or a duration of the vulnerabilities of the computing systems of the entity and (ii) a measure of a resilience of the entity to recover from a security breach corresponding to the vulnerabilities, the measure of the resilience being inversely proportional to a duration of detected malicious activity, and
• providing, via a reporting facility, the composite security rating of the entity.