What should we fix first?

Attribution, before remediating anything. Ratings are calculated against the internet-facing footprint attributed to your organisation, and that attribution is inferred. Divested entities, reassigned IP ranges and shared hosting all put findings against your name that are not yours. Correcting the asset list costs close to no engineering effort, and it is the step most often skipped.

Which findings carry the most weight?

By category, diligence: Bitsight publishes it as 71.5% of the rating, against 26% for compromised systems and 2.5% for user behaviour. By single finding, compromise: one botnet infection or malware server records an incident rather than a weakness and hits hard, which is why it is cleared first. Diligence findings are individually minor and decide the rating cumulatively. Public breach disclosures cannot be remediated at all, only outlived.

How quickly does the rating respond to a fix?

Response time depends on what was fixed. Attribution corrections are fastest, because the finding is removed rather than aged out. Clearing an active compromise registers within days to a few weeks once the observed traffic stops. Configuration fixes are typically visible within one to two weeks of the next observation.

Remediation

How to improve your Bitsight security rating

Name: Bitsight Security Ratings, SPM and TPRM — delivered by BitScore
Brand: Bitsight
Availability: InStock

Check the assets are yours, clear active compromise, then fix the configuration findings that carry 71.5% of the rating. Plus how fast the score responds.

9 min readPublished 28 July 2026Updated 11 October 2026Reviewed by Nimitt Jhaveri

In short

The fastest way to raise a Bitsight rating is to clear active compromise first — botnet infections, malware servers and spam propagation record an incident, not a weakness. Configuration hygiene comes next, and carries 71.5% of the rating: Critical Vulnerability Management, TLS/SSL, web application security, open ports, SPF, DKIM and DMARC. Correct asset attribution before either, since fixing findings on systems that are not yours moves nothing.

Most organisations approach a low rating by working down the findings list from the top. That is the wrong order. Findings are not equally weighted, some are not yours, and a few of them will resolve themselves. A structured sequence typically produces more movement in one quarter than an unstructured effort produces in three.

Step zero: verify the assets are actually yours

Ratings are calculated against the internet-facing footprint attributed to your organisation. That attribution is inferred, and inference has error bars. Before remediating anything, review the asset list.

Common attribution problems, all worth checking:

Shared hosting. If you sit on shared infrastructure, a neighbour's compromise can surface in your findings.
Divested entities. Subsidiaries sold years ago frequently remain attached in the data.
Reassigned IP ranges. Addresses released back to a provider and reissued can linger against your name.
Acquisitions not yet added. The reverse problem — real exposure that is not being counted, which will appear the moment it is.

Getting attribution corrected is usually the single highest-return action available, and it costs engineering effort of approximately zero. It is also the step most often skipped.

Understand what actually moves the number

Signal family	Weight	Why
Diligence / configuration	71.5%	Individually minor findings; collectively the clearest proxy for whether a programme operates
Compromised systems	26%	Evidence that machines are already under external control — not a weakness, an incident
User behaviour	2.5%	File sharing on your network; exposed credentials are shown but informational
Public disclosures	Only when one occurs	Reported breaches; cannot be remediated, only outlived

Bitsight's published risk-category weights. A single compromise event still hits hard, because it records an incident; diligence decides the rating in aggregate.

Weights from Bitsight's own How does Bitsight calculate Security Ratings?

User behaviour is the row with the least leverage inside the rating and the most outside it. Exposed credentials do not move the score at all, and a single working one is how most intrusions start — a mismatch worth understanding before you sequence anything, and what the credential exposure check is for.

The remediation sequence

To get the sequence as a list for your own estate, tick what applies in the fix-order planner.

1. Clear active compromise (days)

Botnet infections, malware servers and spam propagation hit hardest per event and often trace to a small number of machines — frequently forgotten test servers, an unpatched appliance, or a device on a network segment nobody owns any more. Identify, isolate, clean, confirm the traffic has stopped.

2. Fix the certificate and web application layer (days to weeks)

TLS/SSL misconfiguration and weak web application security are the most reliably quick wins in the diligence category. Expired or weak certificates, deprecated protocol versions, and absent browser controls such as HSTS and Content-Security-Policy are visible, unambiguous and usually fixable without touching application logic. Since July 2025 the web vector is Web Application Security, which also counts outdated components, cookie flags and exposed data, so headers alone no longer clear it.

3. Close unnecessary exposure (weeks)

Open ports that serve no current business purpose — legacy management interfaces, database ports exposed to the internet, forgotten remote access. Each one is both a rating drag and a genuine risk, which makes this the least arguable work in the sequence.

4. Complete email authentication (days)

SPF, DKIM and DMARC records are cheap, fast, and improve both the rating and your actual resistance to domain spoofing. DMARC is worth calling out separately: it became rating-impacting only in Bitsight's July 2026 algorithm update, at a 1% weight reallocated from compromised systems. That is a small weight, but it is a point most estates are currently leaving on the table, and publishing a DMARC record is an afternoon's work for anyone who has already done SPF and DKIM. The same update stopped penalising organisations that hold no domains at all, which now return N/A on SPF and DKIM rather than a poor grade. DNSSEC is worth doing for its own sake, but not for the rating: Bitsight lists it as a beta vector, and it does not move the score.

Which of these you are actually missing takes about four seconds to establish: the email spoofing check reads all four from public DNS, in your browser, and says what each one is currently doing. The common finding is not an absent DMARC record but one parked at p=none, which publishes a policy that instructs receiving servers to do nothing.

5. Establish critical vulnerability management (ongoing)

This is the one that determines whether the improvement holds. The vector weights severity: remediating a Material or Severe vulnerability moves the grade considerably more than clearing a backlog of minor ones, and findings age out of the calculation after ninety days. Triage by severity rather than by count — a programme that consistently closes the serious findings first will drift upward without further intervention, while one that does not will erode every gain above.

How quickly the score responds

Ratings are recalculated daily, but the score is not instantaneous, because it deliberately incorporates history — a rating that swung wildly day to day would be useless for underwriting or due diligence.

Attribution corrections — fastest, since the finding is removed rather than aged out.
Compromise clearance — days to a few weeks, once the observed traffic stops.
Configuration fixes — typically visible within one to two weeks of the next observation.
Critical Vulnerability Management — depends on severity; closing a Material or Severe finding registers within weeks, while the weighted average takes a quarter or more to reflect a sustained change in practice.

Bitsight's Dynamic Remediation capability shortens this cycle: once a finding is fixed you can request an immediate rescan rather than waiting for the ordinary observation schedule, so the repair earns rating credit at the next daily update. It is currently live across five risk vectors — SSL configurations, SSL certificates, open TCP ports, server software and web application security — which is worth knowing when planning, because work outside those five still moves at observation pace. Security Posture Management adds a score-response forecast on top, so the projected effect of a fix can be seen before engineering time is committed to it. Sequencing against that forecast is how you avoid spending a quarter on work worth four points.

What a realistic trajectory looks like

An organisation starting in the Basic band with genuine compromise present and no attribution cleanup can often move into the Intermediate band within one to two quarters, because the early wins are large. Movement from Intermediate into Advanced is slower and depends almost entirely on sustained patching discipline and keeping the external surface small. There is no shortcut through that second phase, and vendors promising one are describing a different activity.

Where BitScore support shortens the cycle

Detection is global and remediation is local. That gap is where most of the elapsed time in a score-improvement programme actually goes, and it is the part a global console does not address.

Attribution disputes get resolved, not queued. Global IP allocations, shared regional hosting and group-company structures generate more attribution error than a typical Western footprint. Someone who can assemble the evidence and pursue the correction on your behalf turns a months-long ticket into a short exchange.
Findings get translated into owner-specific work. A raw finding list is not a work plan. Converting it into instructions the network team, the application team and the hosting provider can each act on — in your timezone, with your context — is the difference between a report that is read and a report that is executed.
Third-party and ISP conversations happen in the right register. Much enterprise infrastructure sits with domestic hosting providers, ISPs and managed service partners. Getting a botnet attribution cleared or a certificate reissued often means escalating inside those organisations — materially easier for someone operating in the same market and timezone.
Vendor remediation becomes a relationship. For TPRM programmes, asking a mid-sized supplier to remediate is a commercial conversation as much as a technical one, and it goes better when someone owns it on your behalf.
Board reporting arrives in your regulatory frame. The same score means something different to an audit committee when mapped to the obligations it actually answers to — the SEC disclosure rules, NIS2, DORA, NYDFS Part 500, or RBI and SEBI — rather than presented as a bare global benchmark. What boards must evidence covers that framing.

BitScore delivers the Bitsight platform with that layer attached — personalised and expert advisory, onboarding, remediation guidance and escalation support alongside the global rating. The rating is the same rating anyone can see; what changes is how quickly you can act on it.

Questions this page answers

What should we fix first?: Attribution, before remediating anything. Ratings are calculated against the internet-facing footprint attributed to your organisation, and that attribution is inferred. Divested entities, reassigned IP ranges and shared hosting all put findings against your name that are not yours. Correcting the asset list costs close to no engineering effort, and it is the step most often skipped.
Which findings carry the most weight?: By category, diligence: Bitsight publishes it as 71.5% of the rating, against 26% for compromised systems and 2.5% for user behaviour. By single finding, compromise: one botnet infection or malware server records an incident rather than a weakness and hits hard, which is why it is cleared first. Diligence findings are individually minor and decide the rating cumulatively. Public breach disclosures cannot be remediated at all, only outlived.
How quickly does the rating respond to a fix?: Response time depends on what was fixed. Attribution corrections are fastest, because the finding is removed rather than aged out. Clearing an active compromise registers within days to a few weeks once the observed traffic stops. Configuration fixes are typically visible within one to two weeks of the next observation.
Why does the rating not move the day we fix something?: The rating is recalculated daily but deliberately incorporates history, because a score that swung day to day would be useless for underwriting or due diligence. Bitsight’s Dynamic Remediation shortens the wait on five risk vectors, by letting you request an immediate rescan instead of waiting for the ordinary observation schedule.
How much improvement is realistic in a quarter?: An organisation starting in the Basic band with genuine compromise present and no attribution cleanup can often reach the Intermediate band within one to two quarters, because the early wins are large. Moving from Intermediate to Advanced is slower and depends on sustained patching discipline and keeping the external surface small.