SecurityMetrics

SecurityMetrics SecurityMetrics is a private company specializing in cybersecurity assessment, risk management, and compliance validation services for organizations in the payment card, healthcare, technology, and retail sectors. The firm provides vulnerability assessment, penetration testing, compliance scanning, and advisory services that intersect with standards administered by organizations such as Payment Card Industry Data Security Standard, Health Insurance Portability and Accountability Act, and National Institute of Standards and Technology. Founded to address rising concerns about data breaches during the early 21st century, the company operates in a market alongside firms like Trustwave, Qualys, Rapid7, and CrowdStrike.

Overview

SecurityMetrics offers services intended to identify security weaknesses, validate controls, and support regulatory or standards-driven compliance programs. Its primary audience includes merchants, service providers, and institutions subject to audit by entities including Visa, Mastercard, American Express, Discover Financial Services, and Diners Club International. Offering both automated scanning and manual testing, the company situates itself within an ecosystem that involves auditors, assessors, and certifying bodies such as Small Business Administration contractors, managed security service providers, and firms participating in Federal Risk and Authorization Management Program-style authorization processes.

Services and Products

SecurityMetrics’ portfolio combines technical tools and professional services: - External and internal network vulnerability scanning comparable to offerings from Tenable and Nessus; these scans support remediation workflows aligned with guidance from Center for Internet Security benchmarks and SANS Institute best practices. - Penetration testing and social engineering exercises drawing on methodologies endorsed by Open Web Application Security Project and testing frameworks maintained by Offensive Security and MITRE. - Compliance validation services for standards including Payment Card Industry Data Security Standard, Health Insurance Portability and Accountability Act, and audit-readiness assistance for audits conducted by entities such as Big Four accounting firms. - Security awareness programs and phishing simulation campaigns influenced by training models used by SANS Institute and corporate programs at Microsoft and Google. - Managed scanning as a service integrated with ticketing and workflow tools commonly used in organizations alongside platforms from ServiceNow and Atlassian.

History and Corporate Structure

SecurityMetrics was established in the context of increasing regulatory attention after high-profile breaches and the proliferation of e-commerce. Its growth mirrors consolidation trends seen across cybersecurity, with competitors like Symantec (now part of Broadcom), McAfee, and FireEye evolving through acquisitions. The company’s leadership has interfaced with payment networks including Visa and Mastercard and with compliance organizations such as PCI Security Standards Council. SecurityMetrics functions as a vendor that supplies assessor-style reporting often requested by acquiring banks, payment processors, and merchant services firms like First Data and Fiserv. Corporate governance has included typical private company structures with executive teams reporting to boards and investors similar to private equity relationships seen at firms like Thoma Bravo and Silver Lake Partners.

Standards, Compliance, and Methodologies

The firm’s methodologies map to internationally recognized standards and industry-specific requirements. SecurityMetrics references frameworks and guidance from National Institute of Standards and Technology publications, implements control mappings relevant to ISO/IEC 27001 information security management, and applies vulnerability classification schemes such as those maintained by Common Vulnerabilities and Exposures and Common Vulnerability Scoring System. For payment data, SecurityMetrics’ assessments address controls enumerated by Payment Card Industry Data Security Standard and collaborate with qualified security assessor programs administered by the PCI Security Standards Council. Healthcare engagements involve interpretation of Health Insurance Portability and Accountability Act rules and coordination with compliance officers akin to work performed for entities regulated under Centers for Medicare & Medicaid Services programs.

Notable Assessments and Clients

SecurityMetrics has reported work spanning small and mid-market merchants to larger organizations requiring continuous monitoring. Clients have included payment processors, point-of-sale technology vendors, and healthcare providers who require validation to do business with networks operated by Visa, Mastercard, and major acquirers. The company has delivered assessments referenced in remediation programs following incidents similar in context to breaches associated with retail chains and hospitality brands scrutinized by regulatory responses from bodies like Federal Trade Commission and state attorneys general offices. In B2B contexts, SecurityMetrics’ reporting has been used by chief information security officers and compliance officers alongside third-party risk management processes used by firms such as JPMorgan Chase, Walmart, and Amazon.

Criticisms and Controversies

As with many third-party assessors, SecurityMetrics has faced scrutiny over the limits of automated scanning versus comprehensive, manual testing; critics compare outcomes to investigations by independent researchers at organizations like Krebs on Security and security disclosures publicized by Have I Been Pwned. Debate persists about the sufficiency of passing scans for demonstrating resilience against advanced persistent threats associated with state-linked actors such as those identified by National Security Agency-level advisories. Additionally, vendor-dependent validation models have been questioned in academic and policy forums that include researchers from institutions like Carnegie Mellon University and Massachusetts Institute of Technology, who stress adversary emulation and threat-hunting practices beyond compliance checklists. Some merchant and processor stakeholders have raised concerns about cost, false positives, and the need for clearer alignment between assessor reports and remediation timelines used by acquiring banks and payment networks.

Category:Cybersecurity companies