Bitsight Reviews

We use BitSight to check security scores for my organization, subsidiaries, and providers.

The product helps us identify the vulnerabilities of internet-facing applications.

BitSight is good for us because we require third-party monitoring of vendors as per our new regulations. Since we are a financial company, we need to monitor our suppliers, software design houses, and others to ensure their information security labels.

Bitsight provides comprehensive insights into security posture, enabling us to effectively reduce risks. it increases the security of writing and reduces the risks.

We work directly on their website to define all the assets that we need to scan. We have some meetings with the manager. For example, we set objectives to evaluate cyber risk periodically in our organization. One of these objectives is to assess the rating for our internal enterprise. We maintain a comprehensive database to ensure compatibility with our objectives. We aim to prevent a decrease in our security rating and maintain its value over time.

BitSight provides information about the external servers, botnet infection and credential leaks. It also offers open ports from an external point of view, so we benefit before any adversary misuses the particular servers that are exposed externally.

There has been quite a bit of data discrepancy in BitSight. When we observe a particular event or alert and check it three to four days a month, the alert seems to be gone, but the vulnerability still exists. In addition, certain assets are becoming repetitive for the same vulnerability. We have reported these couple of instances to BitSight, but we haven't received any updates from them yet. So we are unsure if the issue is from the access end or the BitSight end when it fails to detect that particular asset.

We would like to see better data enrichment to give more information about the particular asset. For example, if BitSight scouts a specific website, it tells you that the website is using TLS Version 1.1 or that the web server is accessible using this server. It will be good if it can give a screenshot of what version BitSight scouts and allow us to validate whether it is aligned. Also, I think the alert system can also be fixed. Still, data enrichment is the major issue because we only see some information that is provided by the data and specific fixes about particular vulnerabilities. If we check for remediation tips for certain vulnerabilities, it only gives generic information.

My major interest is in getting signal intelligence, risk vectors, and detailed information that BitSight collects around the attack surface of a company. We integrate this information with our overall cyber detection and counter-response strategy.

All our employees benefit from the information, not directly through BitSight, but through our own security analytics platform. As CISO, one of our objectives was cyber hygiene, and the major provider of metrics for cyber hygiene was BitSight.

We use the solution for monitoring the supply chain and security performance management.

The solution's most valuable feature is third-party risk management. It provides the best capabilities to retrieve information on the security posture of third-party applications without any impact on our vendors' business processes.