What should we fix first?

Attribution, before remediating anything. Ratings are calculated against the internet-facing footprint attributed to your organisation, and that attribution is inferred. Divested entities, reassigned IP ranges and shared hosting all put findings against your name that are not yours. Correcting the asset list costs close to no engineering effort, and it is the step most often skipped.

Which findings carry the most weight?

Evidence of active compromise — botnet infections, malware servers, spam propagation — carries the heaviest negative signal, because it records an incident rather than a weakness. Configuration and diligence findings are individually minor and matter cumulatively. Public breach disclosures cannot be remediated at all, only outlived.

How quickly does the rating respond to a fix?

Response time depends on what was fixed. Attribution corrections are fastest, because the finding is removed rather than aged out. Clearing an active compromise registers within days to a few weeks once the observed traffic stops. Configuration fixes are typically visible within one to two weeks of the next observation.

Remediation

How to improve your Bitsight security rating

Which findings actually move a Bitsight rating, in what order to fix them, and how long the score takes to respond.

9 min readPublished 28 July 2026Updated 5 September 2026Reviewed by Nimitt Jhaveri

In short

The fastest way to raise a Bitsight rating is to clear active compromise first, because botnet infections, malware servers and spam propagation carry the heaviest weight. Configuration hygiene comes second: TLS/SSL, security headers, open ports, Critical Vulnerability Management, DNSSEC, SPF, DKIM and DMARC. Correct asset attribution before either, since fixing findings on systems that are not yours moves nothing.

Most organisations approach a low rating by working down the findings list from the top. That is the wrong order. Findings are not equally weighted, some are not yours, and a few of them will resolve themselves. A structured sequence typically produces more movement in one quarter than an unstructured effort produces in three.

Step zero: verify the assets are actually yours

Ratings are calculated against the internet-facing footprint attributed to your organisation. That attribution is inferred, and inference has error bars. Before remediating anything, review the asset list.

Common attribution problems, all worth checking:

Shared hosting. If you sit on shared infrastructure, a neighbour's compromise can surface in your findings.
Divested entities. Subsidiaries sold years ago frequently remain attached in the data.
Reassigned IP ranges. Addresses released back to a provider and reissued can linger against your name.
Acquisitions not yet added. The reverse problem — real exposure that is not being counted, which will appear the moment it is.

Getting attribution corrected is usually the single highest-return action available, and it costs engineering effort of approximately zero. It is also the step most often skipped.

Understand what actually moves the number

Signal family	Weight	Why
Compromised systems	Highest	Evidence that machines are already under external control — not a weakness, an incident
Diligence / configuration	High, cumulative	Individually minor; collectively the clearest proxy for whether a programme operates
User behaviour	Moderate	Exposed credentials and risky file-sharing associated with your domains
Public disclosures	Situational	Reported breaches; cannot be remediated, only outlived

Relative impact of the main signal families. Exact weightings are proprietary; the ordering is what matters operationally.

User behaviour is the row with the least leverage inside the rating and the most outside it. Exposed credentials do not move a score far, and a single working one is how most intrusions start — a mismatch worth understanding before you sequence anything, and what the credential exposure check is for.

The remediation sequence

1. Clear active compromise (days)

Botnet infections, malware servers and spam propagation are the heaviest negative signals and often trace to a small number of machines — frequently forgotten test servers, an unpatched appliance, or a device on a network segment nobody owns any more. Identify, isolate, clean, confirm the traffic has stopped.

2. Fix the certificate and header layer (days to weeks)

TLS/SSL misconfiguration and missing web application security headers are the most reliably quick wins in the diligence category. Expired or weak certificates, deprecated protocol versions, and absent headers such as HSTS and Content-Security-Policy are visible, unambiguous and usually fixable without touching application logic.

3. Close unnecessary exposure (weeks)

Open ports that serve no current business purpose — legacy management interfaces, database ports exposed to the internet, forgotten remote access. Each one is both a rating drag and a genuine risk, which makes this the least arguable work in the sequence.

4. Complete email authentication (days)

SPF, DKIM and DMARC records are cheap, fast, and improve both the rating and your actual resistance to domain spoofing. DMARC is worth calling out separately: it became rating-impacting only in Bitsight's July 2026 algorithm update, at a 1% weight reallocated from compromised systems. That is a small weight, but it is a point most estates are currently leaving on the table, and publishing a DMARC record is an afternoon's work for anyone who has already done SPF and DKIM. The same update stopped penalising organisations that hold no domains at all, which now return N/A on SPF and DKIM rather than a poor grade. DNSSEC is more involved but sits in the same category of one-time structural fixes.

Which of these you are actually missing takes about four seconds to establish: the email spoofing check reads all four from public DNS, in your browser, and says what each one is currently doing. The common finding is not an absent DMARC record but one parked at p=none, which publishes a policy that instructs receiving servers to do nothing.

5. Establish critical vulnerability management (ongoing)

This is the one that determines whether the improvement holds. The vector weights severity: remediating a Material or Severe vulnerability moves the grade considerably more than clearing a backlog of minor ones, and findings age out of the calculation after ninety days. Triage by severity rather than by count — a programme that consistently closes the serious findings first will drift upward without further intervention, while one that does not will erode every gain above.

How quickly the score responds

Ratings are recalculated daily, but the score is not instantaneous, because it deliberately incorporates history — a rating that swung wildly day to day would be useless for underwriting or due diligence.

Attribution corrections — fastest, since the finding is removed rather than aged out.
Compromise clearance — days to a few weeks, once the observed traffic stops.
Configuration fixes — typically visible within one to two weeks of the next observation.
Critical Vulnerability Management — depends on severity; closing a Material or Severe finding registers within weeks, while the weighted average takes a quarter or more to reflect a sustained change in practice.

Bitsight's Dynamic Remediation capability shortens this cycle: once a finding is fixed you can request an immediate rescan rather than waiting for the ordinary observation schedule, so the repair earns rating credit at the next daily update. It is currently live across five risk vectors — SSL configurations, SSL certificates, open TCP ports, server software and web application security — which is worth knowing when planning, because work outside those five still moves at observation pace. Security Posture Management adds a score-response forecast on top, so the projected effect of a fix can be seen before engineering time is committed to it. Sequencing against that forecast is how you avoid spending a quarter on work worth four points.

What a realistic trajectory looks like

An organisation starting in the Basic band with genuine compromise present and no attribution cleanup can often move into the Intermediate band within one to two quarters, because the early wins are large. Movement from Intermediate into Advanced is slower and depends almost entirely on sustained patching discipline and keeping the external surface small. There is no shortcut through that second phase, and vendors promising one are describing a different activity.

Where BitScore support shortens the cycle

Detection is global and remediation is local. That gap is where most of the elapsed time in a score-improvement programme actually goes, and it is the part a global console does not address.

Attribution disputes get resolved, not queued. Global IP allocations, shared regional hosting and group-company structures generate more attribution error than a typical Western footprint. Someone who can assemble the evidence and pursue the correction on your behalf turns a months-long ticket into a short exchange.
Findings get translated into owner-specific work. A raw finding list is not a work plan. Converting it into instructions the network team, the application team and the hosting provider can each act on — in your timezone, with your context — is the difference between a report that is read and a report that is executed.
Third-party and ISP conversations happen in the right register. Much enterprise infrastructure sits with domestic hosting providers, ISPs and managed service partners. Getting a botnet attribution cleared or a certificate reissued often means escalating inside those organisations — materially easier for someone operating in the same market and timezone.
Vendor remediation becomes a relationship. For TPRM programmes, asking a mid-sized supplier to remediate is a commercial conversation as much as a technical one, and it goes better when someone owns it on your behalf.
Board reporting arrives in your regulatory frame. The same score means something different to an audit committee when mapped to the obligations it actually answers to — the SEC disclosure rules, NIS2, DORA, NYDFS Part 500, or RBI and SEBI — rather than presented as a bare global benchmark. What boards must evidence covers that framing.

BitScore delivers the Bitsight platform with that layer attached — personalised and expert advisory, onboarding, remediation guidance and escalation support alongside the global rating. The rating is the same rating anyone can see; what changes is how quickly you can act on it.

Questions this page answers

What should we fix first?: Attribution, before remediating anything. Ratings are calculated against the internet-facing footprint attributed to your organisation, and that attribution is inferred. Divested entities, reassigned IP ranges and shared hosting all put findings against your name that are not yours. Correcting the asset list costs close to no engineering effort, and it is the step most often skipped.
Which findings carry the most weight?: Evidence of active compromise — botnet infections, malware servers, spam propagation — carries the heaviest negative signal, because it records an incident rather than a weakness. Configuration and diligence findings are individually minor and matter cumulatively. Public breach disclosures cannot be remediated at all, only outlived.
How quickly does the rating respond to a fix?: Response time depends on what was fixed. Attribution corrections are fastest, because the finding is removed rather than aged out. Clearing an active compromise registers within days to a few weeks once the observed traffic stops. Configuration fixes are typically visible within one to two weeks of the next observation.
Why does the rating not move the day we fix something?: The rating is recalculated daily but deliberately incorporates history, because a score that swung day to day would be useless for underwriting or due diligence. Bitsight’s Dynamic Remediation shortens the wait on five risk vectors, by letting you request an immediate rescan instead of waiting for the ordinary observation schedule.
How much improvement is realistic in a quarter?: An organisation starting in the Basic band with genuine compromise present and no attribution cleanup can often reach the Intermediate band within one to two quarters, because the early wins are large. Moving from Intermediate to Advanced is slower and depends on sustained patching discipline and keeping the external surface small.