Domain Rating, Run Rating and Rate Now
A rating always belongs to one discovery run. This page shows where to find the rating of a run, of a domain, and of a single asset, and how to rate a domain that has no rating yet.
Run rating and domain rating are the same page
Two addresses open the same report:
- A run: Discoveries, then open a run. The badge reads Rating for this run.
- A domain: select a domain on Security posture (or open its rating link from an asset). The page shows the latest run that can rate that domain, and the badge reads Standard rating.
The heading shows the target. The subtitle shows the type, the detective that ran and when it started. A line under it shows duration and how many checks ran, failed or did not run, and the credits used.
Choosing which run
Under the heading, the Run switcher lists the runs of the same target, with previous and next buttons. Use it to look at an older run, for example to compare a grade before and after a fix.
If a newer run of the same domain measured fewer sections (an email-only check, for example), a banner reads "This run measures fewer sections, so it has its own rating and does not replace this one." with an Open button for the newer run. A run must measure at least 60% of the methodology's weight to stand for the domain.
If another organisation has rated the domain more recently, a note says "A newer outside-in rating exists from
Tabs
| Tab | What you get |
|---|---|
| Overview | The Rating card with the grade and How is this calculated?, how many of the run's checks feed the rating, a comparison with the previous run, the Sections tiles and Top issues |
| Findings | Every result of the run with where it went (counted, context, or not a rating check). Tick results to Add N to detections |
| Footprint | The domains, hosts and facts the run found |
| Changes | What is new, gone or changed since the previous run of this discovery |
| History | Domain view only. The domain's ratings, run by run, with new and fixed issues. See History and rating changes |
Staff accounts see an extra Pipeline tab. Customers do not.
Note: the Findings tab is where to look for things that never lower the score. Context findings, findings on a shared network edge and results no section covers are recorded there, marked as context or "Not a rating check".
Report (PDF)
On a finished run of a domain, Report (PDF) opens "Create report" so you can make the Digital risk & exposure assessment for the run. It is disabled while the run is still going ("The report can be made once this run has finished."). See Scores in reports.
Repeat
Repeat sets how often the run's schedule runs again: Off, Daily, Weekly or Monthly. Regular runs keep the grade current and give History more points. Each new run uses credits.
A domain with no rating: Rate now
When no run of yours can rate a domain yet, its page reads Not rated and explains why. If the domain can be rated from here, the button is Rate now · 10 credits.
- Select Rate now.
- Read the confirmation, "Rate
now?". It names the domain, the run (Outside-in rating) and the price. - Select Rate for 10 credits. Nothing starts or is charged before this step.
- A toast reads "Rating started". The grade appears when the checks finish, usually within a few minutes. Open the run from Discoveries to watch it.
Choose checks (or Run discovery) lets you pick a different set of checks instead.
Credits are checked before the run is created. If your balance is too low the rating does not start and you are told.
What Rate now costs
| Situation | Cost |
|---|---|
| A new Outside-in rating | 10 credits |
| The same domain rated with the same preset within 24 hours | Free. The earlier run is reused |
| Another organisation has shared a rating and you use the API with shared reuse | Free. See Scoring through the API and MCP |
Automatic rating
Under Settings, Rate new root domains automatically (10 credits each) is on by default. When a root domain is added and your balance allows it, one Outside-in rating run starts. It does not repeat. With it off, new domains show "Not rated" until someone uses Rate now. Existing domains at the time the feature was introduced were not rated automatically. See Sharing, vendor view and domain verification.
Rate all unrated domains at once
On Security posture, if some root domains have no rating, an organisation admin sees Rate N unrated domain(s) · N×10 credits. It asks for confirmation, then starts one run per domain. Domains already being rated, or that your balance cannot cover, are skipped.
Per-asset rating card
The page of a domain asset (and of assets that belong to a domain) shows a Security rating card:
- The grade badge and score, and "Rated
by ". - For an asset that belongs to a domain: "From
, the domain this asset belongs to." - How is this calculated?, Open the run, and a link to the domain's rating page.
- If the domain has no rating: "Not rated", with Rate now and its price. For an asset with no domain we can rate: "Ratings are for domains, and this asset does not belong to one we can rate."
The card only reads existing ratings. It never rates anything by itself.
Use cases and wiring tips
- Rate a vendor domain before signing: open its domain page or use the API, confirm the price, and file the grade with the vendor record.
- Check a fix: after remediation, use Rate now (or Repeat) and compare the new run with the old one in the Run switcher and on Changes.
- Keep a grade fresh: set Repeat to Weekly on your main domains.
- Turn findings into detections: on the Findings tab, tick results and Add N to detections so your team can triage and track them. Accepting or excluding them then changes your security score. See Accepted risk, coverage and recompute.
- See ratings in lists: the asset register shows each domain's latest grade when one exists.