Verifiable Control Rating
A Verifiable Control Rating (VCR), in the context of cybersecurity and external risk management, is a specific type of security rating that quantifies the operational effectiveness and confirmed presence of an organization's security controls from an attacker's unauthenticated, outside-in perspective.
Unlike simple compliance checks or self-attested maturity scores, a VCR is focused on certainty and objective proof. It aims to eliminate ambiguity by providing evidence-based confirmation that a defensive measure—a specific configuration, technology, or policy indicator—is actively in place and functioning as intended against real-world threats.
The VCR is based on the principle that if a security control is verifiably present and correctly configured, it raises the external cost and complexity for an adversary, thus strengthening the organization's defensive posture.
Key Characteristics of a Verifiable Control Rating:
External and Unauthenticated: The rating is derived solely from externally observable, accessible information that does not require any internal credentials or connections. It mirrors an attacker's reconnaissance efforts.
Objective Proof: The rating is not based on the organization's claim of having control, but on the external verification of the control's digital footprint. For example, verifying that a specific security header is present and correctly configured on an HTTP response, or confirming the successful deployment of a particular WAF technology.
Measurable and Quantifiable: It is expressed as a quantifiable score or grade, allowing for benchmarking, trend analysis, and clear communication of security improvements or degradations to stakeholders.
Focus on Positive Indicators: While many security ratings focus on finding vulnerabilities and flaws, a VCR places strong emphasis on the confirmed presence of beneficial security controls. These indicate that the organization has gone beyond the minimum requirements to implement robust defenses. Examples of such positive indicators include:
The detection of a Web Application Firewall (WAF).
The successful configuration and implementation of robust email security records (such as SPF and DMARC).
The use of robust multi-factor authentication (MFA) or single sign-on (SSO) vendors on external portals.
The Verifiable Control Rating is designed to provide security leaders with the absolute certainty needed to justify security investments and demonstrate concrete progress in hardening the organization's external attack surface.
ThreatNG is inherently designed to deliver a Verifiable Control Rating (VCR) by providing Certainty Intelligence and Legal-Grade Attribution for an organization's external security posture. This directly aligns with the VCR concept, which demands objective, outside-in proof of security control effectiveness rather than just policy adherence.
Here is a detailed explanation of how ThreatNG helps establish a Verifiable Control Rating:
External Discovery and Continuous Monitoring
ThreatNG establishes the foundation for the VCR through continuous, unauthenticated reconnaissance.
External Discovery: The platform performs purely external unauthenticated discovery to map the full extent of the external attack surface, using no internal connectors. This means it finds all assets, such as subdomains and mobile apps, from an attacker's perspective.
Continuous Monitoring: ThreatNG continuously monitors the external attack surface. This ensures that the Verifiable Control Rating is always current and immediately reflects any control decay or introduction of new, unverified assets.
External Assessment and Positive Security Indicators
ThreatNG specifically assesses and highlights positive controls that contribute to a strong VCR.
Positive Security Indicators: This feature identifies and highlights an organization's security strengths by detecting the presence of beneficial security controls and configurations. This is the core of establishing the 'Verifiable' aspect of the rating.
Example 1: Web Application Firewall (WAF) Detection: ThreatNG externally discovers and pinpoints the presence of Web Application Firewalls (WAFs) down to the subdomain level, classifying them by specific vendors like Cloudflare, Imperva, or Palo Alto Networks. The simple fact that ThreatNG can objectively detect and identify a WAF on a subdomain serves as proof—a positive, verifiable control indicator.
Example 2: Email Security Controls: ThreatNG verifies the presence of an SPF Record and a DMARC Record through its Domain Name Record Analysis. A successful check indicates that the organization has implemented foundational email security controls to prevent impersonation, thereby contributing positively to the VCR.
Example 3: Secure Headers: ThreatNG validates the presence of security headers, such as Content Security Policy and HTTP Strict Transport Security (HSTS), across subdomains. Its Web Application Hijack Susceptibility Security Rating is derived from assessing the presence or absence of these key headers. The detection of these headers validates that the control is not just documented but actively configured.
Investigation Modules
ThreatNG's investigation modules convert raw findings into the irrefutable evidence required for high-certainty ratings.
Technology Stack Investigation: This module provides exhaustive, unauthenticated discovery of nearly 4,000 technologies comprising a target's external attack surface. The discovery of technologies like Multi-Factor Authentication (MFA) and Single Sign-On (SSO) vendors provides tangible, external proof that security controls are deployed.
Contextual Risk Intelligence (Context Engine™): This is ThreatNG's patent-backed solution that achieves Irrefutable Attribution by correlating external technical findings with decisive context. This context is what transforms a simple "finding" into a "verifiable control" rating. For example:
If a positive security indicator is a third-party authentication vendor, the Context Engine confirms the vendor's presence (a verifiable control). It correlates that with any legal or financial context, eliminating guesswork across the digital attack surface.
Intelligence Repositories
ThreatNG's Intelligence Repositories, DarCache, support the VCR by providing context that enhances the certainty of the control assessment.
Bug Bounty Programs (DarCach Bug Bounty): This repository tracks Bug Bounty Programs and their scope. The presence of an active bug bounty program is a Positive Security Indicator that is externally verifiable and demonstrates an organizational commitment to defensive measures, directly improving the VCR.
Reporting
The reporting directly supports the VCR by providing certainty, context, and mapping to strategic requirements.
Security Ratings (A through F): The VCR's quantifiable output is reflected in the multiple security ratings (e.g., Cyber Risk Exposure, Data Leak Susceptibility), all presented on an A-F scale.
External GRC Assessment: ThreatNG maps findings directly to relevant GRC frameworks such as PCI DSS, HIPAA, and NIST CSF. By finding and validating a control's presence (or lack thereof), it provides the necessary evidence to prove GRC adherence from an unauthenticated, outside-in view.
Complementary Solutions
ThreatNG's Verifiable Control Rating provides an objective, external truth that validates and prioritizes efforts for internal security teams.
Working with Security Monitoring (SIEM/XDR) Systems (e.g., Microsoft Defender XDR, Splunk): An internal SIEM might log a low number of web application attacks, suggesting the WAF is working. ThreatNG can complement this by externally and independently verifying the WAF's vendor and presence via its WAF Discovery and Vendor Identification. If ThreatNG’s VCR confirms the WAF is active (a positive security indicator), the SIEM team can be more confident in trusting their defensive logs. However, if the VCR indicates the WAF is missing on a newly discovered subdomain, it triggers an immediate deployment priority, rather than waiting for an internal scan.
Working with Vulnerability & Risk Management (VRM) Tools (e.g., Tenable, Qualys): Internal VRM tools often identify missing configurations. ThreatNG can complement this by validating which Positive Security Indicators are actually working externally. For example, a VRM tool may detect a misconfigured email server. ThreatNG's check for a valid DMARC Record validates the security outcome from the exterior. If the control is missing externally, ThreatNG's high-certainty evidence helps the remediation team justify resources for the critical fix.
