How is a Bitsight score calculated?

Configuration hygiene — certificates, ports, email authentication and how fast critical vulnerabilities are fixed — now makes up 71.5% of a Bitsight rating.

That figure changed on 16 July 2026, and a good share of what a search returns on the method still describes the version before it. A CISO asked by the board why the number moved, or a third-party risk team setting a contractual floor, needs the current mechanics: nineteen weighted vectors, each graded against everyone else Bitsight rates.

Read from Bitsight's own knowledge base — the calculation article, the risk vector guide, the finding behaviour tables and the normalisation article — and from Bitsight's announcement of the 2026 update, on 10 November 2026. Bitsight calls the algorithm proprietary: what follows is what it publishes, and nothing is estimated.

From observation to rating, in four steps

Bitsight recalculates every rating daily from a year of supporting data, using two classes of evidence it collects from the public internet: configuration it can observe, and security events — machines talking to command-and-control servers, sending spam, distributing malware. Nothing is installed, and nothing is asked of the company rated.

• Findings are attributed and graded. Each observation is mapped to an organisation. Configuration findings are graded GOOD, FAIR, WARN, BAD or NEUTRAL; compromise events are weighed for confidence, severity and duration.
• Findings become a raw score per vector. Bitsight adds the scoring impact of every finding in a vector and divides by a size factor, so a large estate is not punished for being large.
• The raw score becomes a letter. Each vector's raw score is ranked against every organisation Bitsight rates, across industries and countries, and the percentile sets a letter from A to F.
• The letters become one number. The vector grades are combined with fixed weights onto the 250 to 900 scale — 300 to 820 in practice, with an average of 720 — and displayed rounded down to the ten.

The third step is the one most explanations leave out, and it governs everything else. A Bitsight grade is a position in a queue, not a mark against a checklist.

The nineteen vectors and what each weighs

Nineteen vectors move the rating, in four categories. Compromised Systems carries 26% across five vectors — botnet infections, spam propagation, malware servers, unsolicited communications and potentially exploited devices — for which Bitsight publishes only the category weight. User Behaviour is one vector, file sharing, at 2.5%. Public Disclosures has no standing weight at all: security incidents count only when one occurs. Diligence is the rest, and Bitsight publishes it vector by vector.

Four vectors — Critical Vulnerability Management, the two TLS/SSL vectors and Open Ports — carry 55% of the whole rating between them. That is why fixing a 1% vector first is the most common way to spend a quarter and move nothing. The fix-order planner turns the weights into a working sequence for the findings you actually have.

Weight is not the whole story, though. A compromise event records an incident rather than a weakness, and Bitsight states that companies graded B or lower on Botnet Infections are more than twice as likely to suffer a publicly disclosed breach. Its own prioritisation guide, working an example, puts botnet clean-up ahead of Open Ports for that reason.

What changed on 16 July 2026

Bitsight revises the algorithm once a year. The 2026 update made three changes, and they explain most of the stale material still in circulation.

• Patching Cadence is gone. Critical Vulnerability Management replaced it at the same 20%. The old vector was dominated by time to patch; the new one caps the damage a vulnerability can do according to its CVSS severity, and rewards fast remediation of severe ones far more. A finding helps or hurts according to whether it was fixed faster or slower than the company's own mean time to remediate.
• DMARC now counts. It moves the rating at 1%, level with SPF and DKIM. The point came out of Compromised Systems, which fell from 27% to 26% — so Diligence rose from 70.5% to 71.5%.
• No domains, no email penalty. An organisation with no registered domains now gets N/A on SPF and DKIM rather than the F and C it used to receive. One that has domains and lacks the records is still penalised.

A year earlier, the July 2025 update made Web Application Security rating-impacting and took its 5% from Web Application Headers, which has been informational since. So an explanation that lists Patching Cadence, gives Diligence 70.5% or names security headers as a rated vector describes an algorithm that no longer runs — and so does Bitsight's own 2022 PDF on the method, which is still indexed.

Letter grades are percentiles, not marks

Each vector's letter states where an organisation sits among everyone Bitsight rates, size-adjusted:

Two consequences follow. A grade can slip with nothing changed on your side, because the field moved. And the finding grades underneath — GOOD to BAD — are a separate scale: a C is not a WARN, and Critical Vulnerability Management findings carry no finding grade at all, by design.

The 2025 update made the top of the scale more legible for four vectors. With no negative findings, Open Ports, both TLS/SSL vectors and Server Software now score by finding count alone — more clean findings, a higher raw score within the A range — and a clean TLS or Open Ports estate can no longer lose grade from a shift in the curve. Six of the nineteen vectors, about a third of the weight, can be read from outside in under a minute; the domain check grades them live across your subdomains.

How size is taken out

A bank with forty thousand staff will always have more findings than a fifty-person broker. Bitsight's answer is to divide each vector's raw score by a size measure suited to that vector, before the percentile is taken.

• Employee count for the five Compromised Systems vectors, File Sharing and Insecure Systems. Where the headcount is unknown, Bitsight assumes 100.
• Findings count for most Diligence vectors, so the grade is in effect the share of records that are FAIR, WARN or BAD.
• Active IP count for Server Software, and observed devices for Desktop and Mobile Software.
• None for Critical Vulnerability Management, which is not normalised.
• Records and company size for security incidents, on a logarithmic scale with headcount bounded between 100 and 100,000.

Cloud providers and telecoms carriers are left out of the percentile ranking, because their address space is full of customers' machines. For an Indian group, the employee count Bitsight holds is worth checking: a headcount that is wrong by a factor of ten moves every vector normalised by it.

How long a finding keeps counting

Every finding has a lifetime, and the rating is a running sum of findings still inside theirs. Most Diligence findings count for 60 days, desktop and mobile software for 65, Critical Vulnerability Management for 90. A compromise event behaves differently: once the activity has not been seen for three days, its impact declines in a straight line to the end of a 180-day lifetime.

That asymmetry sets realistic expectations. A misconfigured certificate fixed today can be rescanned on request, and most configuration vectors offer that; Critical Vulnerability Management and the compromise vectors do not. A botnet infection cleaned up today is still fading out of the rating six months later.

Day-to-day movement is mostly lifetimes expiring and new observations arriving. The displayed number moves only in steps of ten — Ratings are rounded down in ten-point increments, so an actual 735 is displayed as 730. Bitsight's fluctuation article adds that the rounding depends on previous values, with different criteria for a rise and a drop, and its rating article that any change can be traced to at least one vector.

What appears on the report but does not move it

Several vectors show up in the portal and in reports without touching the number. Reading them as rated is the commonest error in board packs built from a screenshot.

• DNSSEC is in beta and graded, but does not affect the rating.
• Web Application Headers is informational. The header checks that matter now sit inside Web Application Security.
• Exposed Credentials, Domain Squatting and Other Disclosures are informational. Useful intelligence; no rating weight.

Mobile Application Security, which some older lists still carry, was removed from Bitsight's Diligence documentation in August 2026.

Where BitScore fits, and where it does not

BitScore is an authorised Bitsight partner, so this page explains a method we sell access to. The complimentary report we arrange is Bitsight's own output, not ours; our part is reading it with you and working out which findings carry the weight.

What we cannot do is change the method. We cannot see the scoring curves Bitsight keeps proprietary, so we do not forecast points, and nobody outside Bitsight honestly can. The free tools on this site read six vectors from outside; they are not a Bitsight rating, and they will sometimes disagree with one, usually over which assets are attributed to you. And a rating, however calculated, measures only what faces the internet. It says nothing about the controls behind it.

Related reading

• What is a good Bitsight score? — what the number means once you have it.
• How to improve your Bitsight security rating — the order to work the findings in.
• Attribution across Indian group structures — why the estate scored is not always the estate you run.