FICO (Cybersecurity Score)

FICO is not a cybersecurity company — it’s the analytics firm behind the FICO credit score, publicly traded since 1987 and headquartered in Bozeman, Montana. But it operates a cyber risk-rating product, marketed as FICO Cybersecurity Score / Enterprise Security Score, that applies FICO’s core predictive-scoring methodology to a different problem: given a company’s observable network posture, what are the odds it suffers a material breach in the next 12 months. The lineage traces to FICO’s 2016 acquisition of the technology behind QuadMetrics, a University of Michigan spinout that built breach-prediction models from internet-wide telemetry, which FICO folded into its existing Falcon analytics platform.

The pitch is straightforward: condense a complex external security posture assessment into a single three-digit number that risk, compliance, and underwriting teams can compare across a portfolio of vendors or counterparties — the same logic FICO has applied to consumer credit risk for decades. That puts it in direct competition with dedicated third-party cyber risk-rating vendors like BitSight and SecurityScorecard, both of which have far higher visibility and more frequent public updates specifically in the cybersecurity ratings space.

FICO’s advantage is distribution: banks, insurers, and large enterprises already use FICO’s scoring infrastructure for credit and fraud decisions, giving the cybersecurity score a plausible path into existing risk workflows. Its disadvantage is focus — this is a small piece of a much larger, diversified analytics business, and it shows comparatively little recent public momentum or independent validation specific to the security-scoring product itself relative to pure-play competitors.