Bitsight
Connect Bitsight to RAD Security and track the security ratings, risk vector grades and findings of your organization or vendors as findings.
RAD Security connects to the Bitsight API with an API token and imports, for every company you monitor, its security rating, its risk vector grades and its findings. They land in the same external_security_findings data type as your other findings, so you can filter, chart and correlate them with the rest of your data.
Read-only integration. RAD only reads companies, ratings and findings. It never changes your portfolio or anything else in Bitsight.
Prerequisites
- A Bitsight account with API access
- A User API Token from a user who can read the companies you want to monitor
- A RAD Security workspace with integration permissions
- To monitor your own company: My Company set on the Bitsight account
What RAD stores
| Object | RAD data type | One finding per | Refreshed |
|---|---|---|---|
| Security ratings | external_security_findings | company × scope (overall, or one risk vector) × day | every sync, re-stored only when the rating changes |
| Findings | external_security_findings | Bitsight finding | every sync, re-stored only when the company's findings change |
Ratings are trendable
A rating finding carries the rating or the letter grade. Each day keeps its own finding, so you can chart a company's rating over time.
Ratings and grades are mapped to severity gently, so a good result does not read as an alert:
| Overall rating | Severity |
|---|---|
| 740 and above | Informational |
| 640 to 739 | Low |
| Below 640 | Medium |
| Risk vector grade | Severity |
|---|---|
| B, C | Low |
| D | Medium |
| E, F | High |
| Any other grade | Informational |
Findings keep Bitsight's severity
A finding carries Bitsight's severity category, mapped as below. A check that Bitsight graded as passing is Informational, and a finding Bitsight marks as not affecting the rating has the status Other.
| Bitsight category | Severity |
|---|---|
| severe | Critical |
| material | High |
| moderate | Medium |
| minor | Low |
Step 1: Get an API token
Open your account settings
Sign in to Bitsight and open your account settings.
Generate a token
Generate a User API Token and copy it. Generating a new token replaces the previous one, so use a dedicated user if other automation relies on this user's token.
Choose what to monitor
Decide whether RAD should track your own company, every company in your portfolio, or a specific list. For a list, note each company's GUID.
Step 2: Configure in RAD Security
Open Data Sources > Integrations > Vulnerabilities, add Bitsight and fill in the fields.
| Field | Required | Value |
|---|---|---|
| API Token | Yes | The Bitsight API token |
| Monitored Companies | No | own_company (default), portfolio or company_guids |
| Company GUIDs | When using company_guids | Comma-separated Bitsight company GUIDs |
| Maximum Companies | No | The most companies to sync, from 1 to 1000. Default 50. A larger set is cut to this many. |
| Time Budget per Company (minutes) | No | How long one company's read may take. Default 20. A company over budget stores no findings that cycle. |
What verification does
Saving the integration makes one read that proves the token is accepted. For own_company it reads your My Company reference, because that mode cannot work without one. The other modes read one row of your portfolio.
Once the status shows Connected, the first sync imports each company's current rating and findings.
Sync behaviour
- A sync that finishes cleanly is not repeated for 6 hours, because Bitsight findings can take minutes to read.
- A rating or finding set that has not changed since the last sync is not stored again, so the findings table does not fill with duplicates. When any of a company's findings change, its whole finding set is stored again.
- A sync starts no new company after 30 minutes. The remaining companies wait for a later cycle.
- A company RAD cannot read is skipped, so the others still sync. If no company can be read, the sync fails and reports it.
- RAD backs off when Bitsight rate-limits the token and continues on a later cycle.