SecurityScorecard
Connect SecurityScorecard to RAD Security and track the security ratings and issues of your organization, subsidiaries or vendors as findings.
RAD Security connects to the SecurityScorecard API with an API token and imports, for every company you monitor, its security rating (the letter grade and 0–100 score, overall and per factor) and its issues (the individual problems SecurityScorecard found, such as an expiring certificate or an open port). Both land as findings in the shared external_security_findings data type, next to findings from your other integrations.
Read-only integration. RAD only reads portfolios, companies, ratings and issues. It never changes portfolios, follows companies or disputes issues in SecurityScorecard.
Prerequisites
- A SecurityScorecard account on a plan with API access (Pro or higher)
- An API token
- Either a portfolio of companies to monitor or the domains of the companies
- A RAD Security workspace with integration permissions
What RAD stores
| Object | RAD data type | One finding per | Refreshed |
|---|---|---|---|
| Security ratings | external_security_findings | company × scope (overall, or one factor) × day | every sync, re-stored only when the rating changes |
| Issues | external_security_findings | SecurityScorecard issue | every sync, re-stored only when the company's issues change |
Ratings are trendable
A rating finding carries the grade and score. Its id combines the company domain, the scope (overall or factor:<name>) and the day, so each day keeps its own finding and you can chart a company's rating over time.
Ratings are mapped to severity gently, so a good grade does not read as an alert:
| Grade | Severity |
|---|---|
| A | Informational |
| B, C | Low |
| D | Medium |
| E, F | High |
Issues keep SecurityScorecard's severity
An issue finding carries SecurityScorecard's title, recommendation and severity (critical, high, medium, low; info and positive become Informational). Its id is SecurityScorecard's own issue id, so repeat observations update the same finding rather than adding new ones.
Step 1: Get an API token
Open your API settings
Sign in to SecurityScorecard and open your account's API settings.
Create or copy a token
Generate an API token for RAD and copy it. Use a service account rather than a person's token, so the integration survives staff changes.
Pick what to monitor
Note the Portfolio ID of the portfolio whose companies RAD should track, or list the company domains directly.
Step 2: Configure in RAD Security
Open Data Sources > Integrations > Vulnerabilities, add Security Scorecard and fill in the fields.
| Field | Required | Value |
|---|---|---|
| API Key | Yes | The SecurityScorecard API token |
| Portfolio ID | No | The portfolio to monitor; every company in it is synced |
| Company Domains | No | Comma-separated domains to monitor, for example example.com, acme.com. Takes priority over Portfolio ID when set. |
Set one of Portfolio ID or Company Domains; with neither there is nothing to sync.
What verification does
Saving the integration makes one call that lists your portfolios, which proves the token is accepted and the plan includes API access.
Once the status shows Connected, the first sync imports each company's current rating and issues.
Sync behaviour
- Each sync reads the rating and factors of every monitored company, then its issues, one issue type at a time.
- A rating or issue set that has not changed since the last sync is not stored again, so the findings table does not fill with duplicates.
- A mistyped or not-yet-onboarded domain in Company Domains is skipped, so the other domains still sync. If every domain fails, the sync fails and reports it.
- RAD backs off when SecurityScorecard rate-limits the token and continues on the next cycle.