SecurityScorecard

Overview

The SecurityScorecard integration connects Praetorian Guard Platform (PGP) to the SecurityScorecard API to import third-party security ratings data. It is a read-only integration — PGP pulls data from SecurityScorecard but never modifies your SecurityScorecard account.

PGP discovers every company domain across all your SecurityScorecard portfolios and imports their overall scores, letter grades, individual risk factor scores, six months of score history, and active security issues (mapped as Risks with severity levels).

What the Integration Does

When the integration runs, it performs the following steps:

1. Validates your API key by calling the SecurityScorecard portfolios endpoint.
2. Lists all portfolios in your SecurityScorecard account.
3. Lists the companies in each portfolio.
4. For each unique company domain:
   • Creates a domain Asset in PGP.
   • Emits score and grade Attributes on the Asset.
   • Fetches the company's risk factors, emits each factor's score as an Attribute, and creates a Risk for each issue in the factor's issue summary, with mapped severity, a human-readable title, a shared definition, and per-instance evidence.
   • Fetches six months of monthly score history and emits score_history Attributes.

Companies are processed concurrently, up to 10 at a time. Transient API errors (HTTP 429, 5xx, and connection resets) are retried with backoff.

Severity Mapping

SecurityScorecard issue severities are mapped to PGP risk status codes as follows:

Risk Factors

SecurityScorecard evaluates companies across ten risk factor categories. The integration imports each factor's numeric score (0-100) as an Attribute on the domain Asset. The ten standard SecurityScorecard risk factors are:

1. Network Security — open ports, SSL configurations, insecure protocols
2. DNS Health — DNS configuration issues, DNSSEC, MX records
3. Patching Cadence — speed of applying security patches
4. Endpoint Security — endpoint protection and configuration
5. IP Reputation — malicious activity associated with IP ranges
6. Application Security — web application vulnerabilities and headers
7. Cubit Score — proprietary threat intelligence signal
8. Hacker Chatter — dark web and underground forum mentions
9. Information Leak — exposed credentials and sensitive data
10. Social Engineering — phishing and social engineering susceptibility

Note: The factor names are returned dynamically by the SecurityScorecard API (e.g., network_security, dns_health). PGP stores whatever factor names the API returns as Attribute keys on each domain Asset.

Prerequisites

• An active SecurityScorecard account with API access.
• A SecurityScorecard API key (token-based authentication).
• At least one portfolio with companies in your SecurityScorecard account.

How to Get Your API Key

1. Log in to your SecurityScorecard account.
2. Navigate to My Settings (gear icon in the top-right).
3. Select API from the left sidebar.
4. Click Generate New API Token (or copy your existing token).
5. Copy the token — you will paste it into PGP during setup.

For full API documentation, see the SecurityScorecard API Reference.

Setup

1. In PGP, navigate to Integrations from the left sidebar.
2. Locate the SecurityScorecard card.
3. Click the card to open the configuration form.
4. Enter your API Key in the provided field.
5. Click Connect to save and activate the integration.

Field Reference

Data Mapping

The integration maps SecurityScorecard data into PGP entities as follows:

Assets

Attributes

Risks

Each issue in a company's risk factor issue summary is imported as a Risk in PGP.

Risk titles

Each Risk displays the vendor's human-readable issue title (e.g., SSL/TLS Service Supports Weak Protocol). If SecurityScorecard returns no title for an issue type, PGP derives one from the issue type slug (e.g., tlscert_weak_protocol becomes Tlscert Weak Protocol).

Shared definitions

Each issue type carries a definition fetched from SecurityScorecard that includes:

• Description — what the issue is and why it occurs.
• Impact — the potential security consequence if left unresolved.
• Remediation guidance — steps to resolve the issue.

The definition is fetched once per unique issue type during each integration run and attached to all Risks of that type.

Per-instance evidence

In addition to the shared definition, each individual Risk instance includes:

• An overview of the issue: issue type, factor, severity, number of active findings, and score impact.
• Each individual finding, with its first-seen and last-seen dates and its observations (such as affected protocol versions and IP addresses).
• A link to the issue in the SecurityScorecard platform.

If the individual findings cannot be fetched, the Risk keeps the overview and the platform link.

API Endpoints Used

All API calls are made to https://api.securityscorecard.io using the header Authorization: Token {api_key} (note: Token format, not Bearer).

Troubleshooting

Authentication Failed (HTTP 401)

If you see a credential validation error, verify that:

• Your API key has not expired or been revoked in SecurityScorecard.
• You copied the full API key without leading or trailing spaces.
• Your SecurityScorecard account has API access enabled.

No Data Imported

• Ensure your SecurityScorecard account has at least one portfolio containing companies.
• Check your PGP asset filters — domains may be filtered out by your VM filter configuration.

Companies With No Factors or Risks

If SecurityScorecard refuses the factors request for a company (for example, a private custom scorecard not shared with the API key's user returns HTTP 403), PGP logs a warning and skips that company's factors and risks. The company's Asset, score, and grade are still imported.

Missing Definitions for Some Issue Types

If the SecurityScorecard API does not return a definition for a given issue type, the Risk is still created with the available title and evidence. The description, impact, and remediation fields will be absent for that type only.

Integration Timeout

The integration has a timeout of 120 seconds. If you have a very large number of portfolios and companies, the integration may time out. Contact support if this occurs consistently.

Duplicate Domain Handling

If the same domain appears in multiple portfolios, PGP processes it only once. The deduplication is automatic.