From 88 Suppliers in Two Years to a Million Assessments a Day: Announcing the Universal Cyber Risk Score

Leave a Reply · 10/11/2026 · 15, 15, 15, 15, 15 popular

On my birthday, after about 96 hours of intense engineering, Cyber Tzar has reached a milestone: a new triage capability that supports more than a million triage-level organisational assessments daily. Built on five years of evidence covering over 7.4 million organisations, it brings the Universal Cyber Risk Score closer to launch: a public score and comparative index grounded in observed vulnerabilities, contemporary threats and real supplier dependencies.

Executive Summary

On Tuesday 10 November 2026, my birthday, I am marking an engineering milestone at Cyber Tzar. Over five years of accumulated cyber risk evidence, covering more than 7.4 million organisations, now underpins a rapid triage capability that supports more than a million checks a day. The breakthrough isn’t just speed and efficiency: it is the ability to make detailed risk intelligence useful at population scale.

The underlying methodology is the Virtuous Triangle, which connects observed vulnerabilities, contemporary threat intelligence and contextual risk assessment. Cyber Tzar combines this with progressive assessment depth, recursive supplier analysis and concentration-risk discovery. The Universal Cyber Risk Score will present results as a public score from 0 to 1,000 and a comparative index, while deeper intelligence remains available through Cyber Tzar.

The public service has not launched yet. The pre-beta website is live, with illustrative data and early-access registration. When the service opens, I want people to compare their organisation with competitors and suppliers, discover risks across their wider ecosystem, and use that knowledge to make better decisions.

The Universal Cyber Risk Score is currently in pre-beta. Visit CyberSecurityScore.com to explore the illustrative experience and register for early access ahead of the public launch.

Contents

Table of Contents

A Birthday Milestone, Five Years in the Making

Today is November 10, my birthday. I’m 56, and by the power of autism and hyperfocus, I have murdered sleep. I’ve just spent over 96 hours in an intensive engineering sprint, working on a problem that has occupied me, in one form or another, for years: how do we make cyber risk measurable, comparable, and useful across millions of organisations, not just the handful that can afford lengthy assessments?

The immediate result is a new Cyber Tzar triage capability supporting more than a million organisational assessments a day. The bigger story is what makes those assessments meaningful. Cyber Tzar has spent five years accumulating vulnerability, threat and risk intelligence covering approximately 7.4 million organisations. The last four days did not magically create that evidence. They unlocked a new way to apply it, rapidly and economically, at population scale.

We are now preparing the Universal Cyber Risk Score: a public-facing score and comparative index intended to make externally observable cyber exposure understandable across organisations, domains and supply chains. Imagine being able to look up your organisation, compare its cyber exposure with competitors, and then examine the suppliers on which you depend. Think of the usefulness of a financial credit score, but applied to cyber risk. The analogy isn’t that cyber risk and creditworthiness are identical; it is that a complex body of evidence can be translated into a consistent point of comparison without revealing the proprietary intelligence infrastructure beneath it. The website is live and collecting registrations of interest, but the public scoring service has not yet launched. This is the road to launch, not the launch itself.

The Universal Cyber Risk Score pre-beta website: registration is open ahead of the public launch; preview data is illustrative.

And the day isn’t over yet. Later this evening, I’m heading into town for dinner with the wonderful team behind CyberASAP, ahead of speaking to the programme’s researchers tomorrow, Wednesday 11 November, about my journey as a founder and entrepreneur. I’ve mentored on CyberASAP for a couple of years, and I care enormously about helping academics become entrepreneurs and founders. I also genuinely love the team behind the programme; they’re fantastic people doing important work. My advice to the researchers will be fairly straightforward. First, understand the corporate vehicles available to you, how companies work, and how to establish an appropriate structure to hold and protect your intellectual property. Second, establish a clear, firmly bounded relationship with your university and its intellectual property department, including who owns what, what rights are being licensed or transferred, and on what terms. I’ve seen too many promising academic ventures struggle because they didn’t establish those boundaries early enough. Brilliant research deserves the chance to become a successful business, and I love encouraging more researchers to make that leap.

Twenty-Five Years of Frustration with Cyber Risk Assessment

The road to this point has been considerably longer than five years. In 2001 and 2002, I conducted security assessments with the cybersecurity team at Sun Microsystems, alongside some extraordinary people. There was Alec Muffett, creator of the pioneering password-cracking tool Crack; Dave Walker, who later took senior roles at AWS; Ben De la Salle, who later became a serial CISO; and people like Robin Wilton, along with many other brilliant security and identity specialists. It was an extraordinary environment to learn and work in. But even then, something about the assessment process bothered me. We could spend three or four days, sometimes longer, gathering technical evidence, and then spend just as long translating enormous quantities of findings into something meaningful for a business leader, senior technologist or operational manager. Despite the quality of the people involved, the assessor’s own experience inevitably coloured the resulting assessment. One person might consider SQL injection the most pressing concern, another might focus on cryptographic weaknesses, while I might be particularly concerned about man-in-the-middle attacks. These were all legitimate technical concerns, but their relative importance could depend too heavily on who was conducting the assessment. I wanted a more consistent, comparable, evidence-led way to determine what actually mattered.

Years later, at Bupa, I encountered the same problem on a much larger scale. We assessed shadow IT suppliers, with a team of information security consultants following a familiar process: identify the supplier, establish contact, obtain ISO 27001 documentation, request penetration-testing schedules and redacted reports, understand the business use case, and then determine the associated risk. Different consultants could still interpret the same evidence differently, and final sign-off meetings sometimes added another layer of subjectivity. I remember being particularly uncomfortable when risk acceptance became part of a negotiation over budgets or additional resources. Risk should be understood and managed on the strength of evidence, not adjusted to suit an organisational bargain. The elapsed time was equally frustrating. Suppliers sometimes didn’t even know that Bupa was using their technology, so simply finding the right person to speak to could take weeks. Once everything was available, an assessment might take only a few days of focused work, but conversations, documentation requests, and approvals could stretch the process over two or three months.

Over two years, we identified and assessed 88 shadow IT suppliers. When I spoke to colleagues at DWP, they had assessed roughly 100 over a similar period with a comparably sized team, which suggested that the problem was systemic rather than peculiar to Bupa. But Bupa had thousands of suppliers in total, and I couldn’t escape the absurdity of the economics. We were investing years of skilled effort to understand a tiny fraction of a much larger population. I wanted to assess all suppliers, including the 88 shadow IT suppliers, in about a week, apply sectoral analysis and alternatives, then put the results in front of management so we could stop spending most of our time discovering problems and start fixing them. That frustration became a foundation of the risk management platform that ultimately led to Cyber Tzar: gather empirical evidence at scale, minimise the influence of individual assessor preferences, use contemporary threat intelligence to establish vulnerability relevance, and make assessments consistent enough to compare across entire populations.

Once you’ve identified a supplier with poor security, the practical choices are relatively straightforward. You can accept the risk, which is sometimes necessary but rarely satisfying. You can work with the supplier to improve its security, which I particularly favour. Or you can find an alternative and offboard the supplier. Cyber Tzar is designed around that second possibility as much as the assessment itself: suppliers should be able to engage with the platform, understand the evidence, address their weaknesses, and demonstrate improvement. Faster, more consistent risk assessment is not simply about producing more scores. It frees people from an extraordinarily slow discovery process and gives them the information, time, and opportunity to make organisations and their supply chains more secure.

The Virtuous Triangle: The Engine Beneath the Score

The intellectual linchpin is what I described in July 2025 as the Virtuous Triangle: vulnerability assessment, threat intelligence and contextual risk assessment. Vulnerability intelligence tells us what is actually exposed. Threat intelligence tells us what adversaries are doing, which weaknesses they’re exploiting, and how the threat landscape is changing. Risk assessment correlates the two at a given point in time to determine what deserves attention and why.

None of those disciplines is sufficient alone. A vulnerability without contemporary threat context can be misleading; threat intelligence without an understanding of the exposed population lacks a target; and a risk score without defensible underlying evidence is just a number. The triangle is virtuous because each element informs the others. Observations sharpen threat relevance, threats change the significance of observations, and the resulting assessments tell us where to investigate, remediate or monitor next.

The Virtuous Triangle: Cyber Tzar correlates vulnerability assessment, threat intelligence and contextual risk assessment.

The distinction is not simply between one cyber rating and another. Cyber Tzar brings together observed technical exposure, contemporary threat intelligence, contextual risk assessment and discovered supplier dependencies, including recursive third-party and concentration risk. The objective is not merely to produce a comparative number, but to make the underlying evidence actionable across entire populations of organisations.

The Universal Cyber Risk Score is not a checklist with arbitrary weights. Cyber Tzar produces time-specific risk assessments by correlating observed vulnerabilities and relevant threats, then compares those assessments across the assessed population. The public score expresses an organisation’s assessed cyber risk on a scale from 0 to 1,000, where higher is better. The index shows where that organisation stands relative to others, including comparisons across industries and countries. The two are related but distinct: the score makes the assessment accessible; the index enables comparison.

The UCRS website distinguishes the 0–1,000 score from the comparative index.

This has been a long-running programme of thinking and engineering. I have written about the history of risk quantification, cyber risk scoring and benchmarking, their application to insurance, and the limitations of consulting-led security models. The Virtuous Triangle supplied the operational synthesis. In July 2025, I was writing about its application across more than 130,000 organisations. Today, our accumulated dataset covers approximately 7.4 million organisations. The new triage engine is the capstone, applying the same philosophy at a dramatically faster pace.

Three Assessment Phases, One Evidence-Driven Architecture

Cyber Tzar’s assessment process is deliberately phased. It begins with Cyber Tzar Triage, moves to a comprehensive Non-Intrusive Assessment, and can extend to a Complete Assessment that includes intrusive active tests only with explicit permission. Moving from broad triage towards deeper testing brings richer evidence and a more specific understanding of exposure. The three phases complement each other; they are not interchangeable. The Virtuous Triangle operates across all three phases: evidence is acquired and correlated with threat intelligence throughout the assessment process, rather than risk assessment taking place only after all scanning has finished.

Cyber Tzar Triage is not a cursory website check or a superficial preliminary step. It is a substantive, standalone assessment that examines reachability; delivery infrastructure including proxies, CDNs, redirects, DNS, TLS and caching; security exposure including software, headers, cookies, disclosure, content security, CSP and CORS; application architecture and technologies; organisational infrastructure, vendors and discovery; and the supply chain. Even at this initial level, it discovers third-party dependencies, assesses upstream supplier exposure and identifies concentration risk. That gives organisations an actionable first view of risk across large populations before more comprehensive assessments begin. Indicative findings can appear quickly, but triage is complete only after incorporating applicable upstream supplier assessments and concentration-risk analysis.

One particularly exciting consequence is the ability to identify technologies, software, and observable software versions across enormous populations of organisations, then correlate those findings with emerging vulnerability and threat intelligence. When a serious vulnerability appears in a widely deployed technology, such as the recent “PHP2Shell” issues (CVE-2026-109618 and CVE-2026-109619), we can quickly identify which organisations run potentially affected software, rather than starting thousands of individual investigations from scratch. We can also examine which suppliers and customers may inherit exposure through their dependencies. This is where high-throughput triage, the Virtuous Triangle, and recursive supplier discovery become especially powerful: the intelligence helps score risk and identify where attention and remediation may be needed across an entire ecosystem.

Comprehensive non-intrusive assessments build on that picture, examining externally observable infrastructure, ports, services, software, and vulnerabilities in greater depth without making system changes. Complete assessments add authorised intrusive testing. We assemble those deeper assessments from multiple components: web, infrastructure, DNS, certificates, and other checks can finish at different times, sometimes separated by half an hour or more. We expose useful findings as they arrive rather than withholding everything until the last component finishes. When all applicable components have run, the assessment is complete.

Crucially, the scoring relationships between the three levels are algorithmically connected and continuously renormalised as new data arrives. We calculate measures of agreement, error, and bias; test those relationships against independent data; and correlate assessments with breach intelligence and observed incidents. These analytical processes are part of the platform’s day-to-day operation. The underlying validation data and model details remain proprietary Cyber Tzar intelligence; publishing a useful score does not require publishing the entire machinery that produces it.

Cyber Tzar’s phased assessment process: from rapid triage to deeper, permission-based testing.

We Do Not Fictionalise Risk

One non-negotiable principle underpins all this: we do not fictionalise risk. We collect actual observations, identify observed weaknesses, investigate real threats and discover real technical dependencies. We don’t invent missing vulnerabilities, presume unobserved controls exist, assign fictional business criticality, or manufacture financial loss estimates just because those numbers would make a model easier to complete.

If we haven’t seen something, we haven’t seen it. That doesn’t mean it doesn’t exist. A completed assessment means the applicable assessment process has finished; it does not mean every possible weakness in an organisation has become visible. Analytical calibration between triage and deeper assessments rests on empirical relationships, not invented underlying observations.

Assessments also preserve their history. A provisional score can change as its web, infrastructure and supplier evidence arrives. Once an assessment is complete, its score is fixed. New threat intelligence, changing population comparisons and refinements to the scoring methodology do not rewrite that completed score. We assess forward: a new assessment produces a new result, preserving what was actually known and assessed at the earlier point in time.

The Risk You Inherit: Organisations, Domains and Suppliers

Working in the West Midlands has also sharpened our understanding of why supply-chain risk matters. This region is built around advanced manufacturing, automotive, aerospace, logistics, and complex industrial supply chains, where the consequences of a cyber incident can extend far beyond the organisation initially affected. A vulnerable supplier, a shared service provider, or a concentration of dependencies can create problems for an entire network of businesses. Alongside growing procurement and resilience pressures, that industrial reality has reinforced our focus on discovering and assessing supplier relationships, including recursive dependencies and concentration risk. Understanding an organisation in isolation is not enough; we need to understand the wider ecosystem it depends on.

Cyber risk does not respect a company’s organisational chart. Cyber Tzar assesses three related but distinct subjects: organisations, domains and subdomains. A business can own several domains, use a subdomain on someone else’s platform, and rely on services it doesn’t operate. Do not confuse ownership, configuration responsibility, and inherited dependency risk.

Consider a business publishing at a Substack subdomain. The business owns its presence and content, while Substack operates the underlying platform. The business is the customer, and Substack is a supplier. Understanding that relationship is more useful than indiscriminately blaming the customer for every platform issue or pretending the customer has no inherited risk.

The same principle extends through cloud providers, hosting services, DNS, SaaS, managed service providers, software and suppliers’ own suppliers. Automated discovery allows Cyber Tzar to examine these relationships recursively. It also reveals concentration risk: several apparently independent vendors may rely on the same underlying provider, technology or infrastructure. A single disruption or exploitable weakness can therefore affect multiple business services at once. A supplier’s ISO 27001 certification does not automatically certify its customers or eliminate their operational dependencies.

This is why our initial triage must incorporate upstream suppliers before it is final. We don’t simply score a company’s website in isolation. We examine its observable exposure within the technical ecosystem it depends on.

The Economics of Assessing Everybody

Traditional third-party risk management has often focused on a limited number of strategically important suppliers, using questionnaires, certifications, shared documentation, and manual review. Those activities have a place, but they do not answer the question that keeps many CISOs awake: what about the thousands of suppliers we have never meaningfully assessed?

If a CISO hands Cyber Tzar a list of 10,000 suppliers, we can produce useful, prioritised triage intelligence across that population in less than a day, including upstream dependencies and concentration risk. Producing polished, customer-ready reporting may take two or three days. Comprehensive non-intrusive assessments across the same 10,000 organisations take approximately a week. These are indicative operational timings, not a promise that every environment or dataset will behave identically. But they show the economic shift: whole-population assessment becomes a practical starting point rather than an unattainable aspiration.

That difference matters for managed service providers too. An MSP with a thousand customers does not need another thousand generic reports. It needs to know which customers have observable weaknesses, which threats make those weaknesses urgent, and where remediation effort can make the greatest difference. Data becomes valuable when it helps the business act.

From Cyber Intelligence to Business Outcomes

Customers repeatedly tell us they value Cyber Tzar for one thing: not another vulnerability inventory, compliance exercise, or unexplained rating, but information meaningful enough to change business outcomes. An IT department can use it to protect its systems. A CISO can prioritise suppliers. An MSP can serve customers more effectively. An insurer can understand technical exposure across a portfolio rather than relying solely on financial proxies such as turnover and industry classification.

In one insurance engagement, vulnerability intelligence supplied by Cyber Tzar contributed to approximately £40,000 in additional revenue on a single sale. That is an example of what better information can make possible: a commercial decision improved by understanding observed technical exposure. We are also seeing customers migrate from established cyber ratings providers because they want intelligence they can investigate and act on, not just a number for a presentation.

We also examine the relationship between historical scores and real-world incident data, including breach intelligence such as Have I Been Pwned and information captured through our own platform. Particularly poor scores can be associated with substantial susceptibility to common automated attacks. That does not make the score a crystal ball, and correlation does not prove that a particular observed weakness caused a subsequent breach. It does, however, give us an empirical way to test whether our assessments distinguish meaningful differences in observed exposure.

My background in large-scale data systems predates Cyber Tzar. I worked on the Home Office’s big-data and border-security modernisation efforts, including distributed processing, data integration and identity matching. Those experiences taught me that collecting information is easy to describe and hard to engineer well. The real work lies in attribution, provenance, normalisation, correlation, processing efficiency, and decision usefulness. The new triage capability draws on that experience and on five years of accumulated Cyber Tzar evidence.

A Public Score, Not a Giveaway of Proprietary Intelligence

The Universal Cyber Risk Score is intended to be freely useful. I want people to understand their organisation’s score, its position in the index, and how it compares with others without first purchasing a consultancy engagement. Financial credit reference agencies provide a useful analogy: the public can use a simplified score without the agency disclosing every underlying commercial model, dataset, or coefficient.

Cyber Tzar’s accumulated evidence, algorithms, threat correlations, supplier intelligence, calibration and outcome analysis are substantial proprietary assets. Organisations that want to investigate the evidence behind their score, monitor supplier portfolios, get deeper assessments, or incorporate the intelligence into their operations can work with the Cyber Tzar team. We can explain our methodology and support appropriate corroboration without giving away the intellectual property built over years of work.

A broader principle behind this matters enormously to me: democratisation. I’ve always believed in democratising data, functionality, and capability, taking things once available only to the largest, wealthiest, or most technically sophisticated organisations and making them accessible to everyone. Cyber risk intelligence should be no exception. If we can deliver enterprise-class assessment capabilities at population scale, why should understanding cyber risk remain the privilege of organisations with six-figure security budgets? The Universal Cyber Risk Score reflects that belief: giving everyone access to a meaningful, evidence-driven view of cyber risk, while making deeper analysis and remediation capabilities available through Cyber Tzar.

The ambition is bigger than a public lookup tool. We want to make a common language for cyber exposure available across organisations, suppliers, sectors and ultimately the global population of relevant domains. The score is an accessible starting point, not the whole product, and certainly not the whole intelligence platform.

The Road to Launch

The website at CyberSecurityScore.com is live, showing an illustrative preview and accepting registrations of interest, but the Universal Cyber Risk Score has not yet had its public launch. We want to do that properly, with a marketing campaign, conversations with journalists and engagement with the academic and research community. I have been invited to speak with academics involved in the CyberASAP programme, and that is part of the next stage of the journey. We have not set a launch date, and I am not going to invent one for the sake of a headline.

When we do open the service, I know exactly what I want people to do. Look up your own organisation. Then look up the competition. Then look up your suppliers. Follow the relationships and discover how your cyber exposure connects to the wider ecosystem. I want that experience to produce curiosity, surprise and perhaps a slightly uncomfortable realisation about the dependencies we all take for granted. Then, perhaps, people will think: this is clever; what else does Cyber Tzar know, and could that intelligence help us?

That is the invitation, and it is deliberately not a sales pitch. The public service should demonstrate its usefulness before anyone needs to talk to an account team. If people want the deeper evidence and the ability to turn it into action, the conversation with Cyber Tzar can follow naturally.

First, however, I intend to get some sleep. Ninety-six hours of concentrated engineering is not a sustainable way to operate, and recovery matters, particularly when managing autistic burnout. After that, there will be time for journalists, academic conversations, and the launch campaign.

Five years of evidence. Ninety-six hours of engineering. More than a million assessments a day. The Virtuous Triangle, finally applied at the scale needed to make a universal comparative cyber risk score practical. Not a bad birthday milestone, really.

The Universal Cyber Risk Score is coming. In the meantime, register your interest at CyberSecurityScore.com and when the doors open, start with your own organisation, compare it with the competition, and then take a long, hard look at your suppliers.

Selected Background Reading