Security scorecards

External security ratings score what can be observed from outside: certificates, exposed services, published records.

That is a genuine signal about hygiene and a poor proxy for internal security, which is invisible to them. They are increasingly used in procurement, which means the score has business consequences regardless of its accuracy, and organisations end up managing the rating as well as the risk.