DefScore
Log inCreate account

Modular cybersecurity platform

Know your cyber risk.
Prove what improves.

DefScore is a modular platform that turns authorised checks, organisational answers and evidence into an explainable security posture — a 0–100 DefScore with visible coverage, and a prioritised plan of what to fix next.

Get started Log inCompare plans
Security vital signs
Illustrative
T−30dT−20dT−10dnow
Cyber riskMonitoringNIS2 readinessRisk signal
  • Cyber Risk / DefScore
    Illustrative
  • Continuous Monitoring
    Scope required
  • NIS2 Readiness
    Evidence-led
  • Attack Surface
    Authorised only
  • Phishing Risk
    Not assessed
Conceptual view. Unassessed signals stay visible — they are never counted as secure.

What DefScore sees

Every source, clearly labelled. Nothing unknown passes as safe.

A credible risk picture combines what can be observed, what the organisation declares and what can be proven. DefScore keeps each source distinct.

Observed

Authorised external exposure checks

Domains, public services and certificates within an approved scope.

Observed

Email & identity posture

SPF, DKIM, DMARC and identity-protection signals.

Declared

Organisational questionnaires

Policies, processes and responsibilities, recorded as declarations.

Evidence

Uploaded and collected evidence

Documents and artefacts that substantiate a control.

Later

Approved integrations

Optional cloud and endpoint telemetry, only when authorised.

Not assessed stays visible. Areas without data lower coverage and are reported as unknown — never silently scored as secure.

Modules

One platform. The modules you need.

Every DefScore module shares the same assets, evidence, findings, remediation and reports — nothing is collected twice. See which plans include each capability.

Plans

Choose the level of protection your organisation needs.

Basic, Silver and Gold deliver recurring security value, with a clear set of included capabilities in every plan.

From signal to decision

A traceable chain from raw signal to proven improvement.

Every score can be followed back to findings, and every finding back to its evidence and source.

  1. 01

    Signals & declarations

    Checks and answers within authorised scope.

  2. 02

    Evidence

    Artefacts that substantiate or contradict.

  3. 03

    Findings

    Risks with severity, confidence and affected assets.

  4. 04

    Score & coverage

    Explainable 0–100 plus how much was assessed.

  5. 05

    Prioritised remediation

    Actions ranked by risk, effort and owner.

  6. 06

    Reassessment

    Verified change over time — proof of improvement.

Two perspectives, one truth

Clear for the boardroom. Precise for the engineers.

Management

Understand risk and decide with confidence

  • Overall posture and coverage in plain language
  • Top risks explained by business impact
  • Trend across reassessments
  • Priorities that support budget decisions

IT & Security

Act on specifics and verify the fix

  • Affected assets for every finding
  • Evidence, source and confidence per observation
  • Severity-ranked remediation with owners and deadlines
  • Verification status after each change

Reporting

Reports that hold up to scrutiny.

Reporting is a core outcome. Every report retains its scope, methodology version, evidence context, limitations and comparison with previous assessments.

Executive report

Cyber Risk Assessment

Methodology v—
Score

Scope

Coverage

Limitations

Key findings · Evidence · Remediation

Historical comparisonLayout preview — no data

Executive report

Posture, coverage, key risks and business impact for leadership.

Technical report

Findings, affected assets, evidence and remediation detail.

Periodic / progress report

What changed, what was verified and how the trend developed.

Module reports

NIS2 readiness, phishing risk and cyber insurance readiness.

Methodology & trust

Principles we do not bend.

Authorised scope only
Checks run only against assets the organisation has approved.
Evidence-backed findings
Every finding references its supporting evidence.
Provenance is explicit
Declared, observed, evidenced, inferred and AI-suggested are always distinguished.
Unknown remains visible
Gaps reduce coverage; they are never assumed secure.
Explainable, versioned methodology
Scores are traceable and tied to a methodology version.
Honest about limits
An assessment is not a penetration test or guarantee; readiness modules are not legal certification.

Build a security posture you can explain.

Start with a scoped assessment and see exactly what is known, what is not, and what to do next.

Create accountCompare plans

Already a customer? Log in