BitSight
BitSight sells cyber risk ratings and exposure data used by insurers, regulators, and enterprises.
On the record
Checkpoint: Moody's decision on its $250M stake: raise ownership, hold, or divest/acquire outright
The call
BitSight's data and regulatory ties keep it embedded for now, while flat valuation, shrinking headcount, and a new CEO point toward a Moody's-driven outcome rather than independent growth.
BitSight scans tens of millions of organizations and gives them cybersecurity scores that insurance companies and regulators use to make decisions. It is hard to copy because it has spent over a decade collecting real security data from those scans, and insurance companies and regulators have written BitSight's scores into their official rules and processes. However, rivals like Palo Alto offer similar scanning tools, and new AI chatbots could make parts of BitSight's work cheaper by automating the paperwork side of what it does. The big question is whether Moody's, BitSight's largest owner, will buy the company outright, sell it off, or keep it running to squeeze cash, since no one has invested new money in BitSight for almost five years and it is shrinking its team.
Why
01
AI pressure: AI-driven questionnaire and control-mapping tools like Vanta AI and Conveyor AI. AI agents auto-fill vendor security questionnaires, shrinking the manual GRC work that BitSight ratings feed into. Could AI do the core job? Only partly.
02
Bigger players: Palo Alto Networks (Cortex Xpanse) and GRC platforms ServiceNow, OneTrust, Archer. These platforms could add native ratings feeds or exclusive rival integrations, cutting BitSight out of renewal decisions. Could a giant copy it? Probably.
03
What protects it. Decade-plus proprietary scan data on 40M+ organizations, a 250-900 rating scale embedded in insurance and DORA/NIS2 compliance workflows.
What would change this call
ServiceNow, OneTrust, or Archer ships a native ratings feed or exclusive rival integration. would show GRC platforms bypassing BitSight as the default ratings source.
Moody's raises stake, spins in, or divests BitSight within 12-24 months. would clarify whether BitSight becomes fully owned, absorbed, or sold off.
Headcount falls further below ~800 or stays flat through 2026-2027. would confirm cost-cutting mode rather than renewed growth investment.
Moody's raises stake, spins in, or divests BitSight within 12-24 months. would clarify whether BitSight becomes fully owned, absorbed, or sold off.
Headcount falls further below ~800 or stays flat through 2026-2027. would confirm cost-cutting mode rather than renewed growth investment.
Key numbers
- $2.4B valuation unchanged since Sept 2021
- Headcount down ~19% from 2023 peak to ~800
- Revenue near $200M ARR
Named risks
- No new funding round in 58 months as of mid-2026 while valuation stays flat at $2.4B since 2021.
- Headcount down about 19% from 2023 peak alongside falling web traffic in 2026.
- GRC platforms like ServiceNow, OneTrust, Archer could embed native or rival ratings feeds, eroding pricing power.
- New CEO John Clancy (since April 2026) faces reported cross-team cohesion and communication challenges.
- Moody's, as largest shareholder, could pursue acquisition, spin-in, or divestiture, altering independence.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| SecurityScorecard | contesting | Described as closest direct rival with 12M+ companies rated via A-F grading, ongoing as of 2026 |
| Palo Alto Networks (Cortex Xpanse) | gaining on | Adjacent EASM/exposure-discovery incumbent shipping competing attack-surface tools as of 2026-07-13 |
| ServiceNow, OneTrust, Archer | gaining on | GRC platforms could embed cheaper native ratings feeds, risking BitSight's role as embedded data feed |
| Moody's | contesting | Largest shareholder since Sept 2021 $250M stake; potential acquirer or divestor, outcome undecided as of 2026 |
Questions people ask
- Is BitSight profitable in 2026?
- Profitability is not disclosed. Third-party estimates put 2025 revenue around $181.9M to $210.1M, but BitSight has not raised new capital since Moody's $250M investment in September 2021, and its $2.4B valuation has stayed flat since then, suggesting a maturing rather than high-growth trajectory.
- Who owns BitSight?
- BitSight is privately held. Moody's Corporation became its largest shareholder in September 2021 after investing $250M for a minority stake, valuing the company at $2.4B, a valuation that remained unchanged as of April 2026 with no newer funding round disclosed.
- Could AI replace BitSight?
- Unlikely soon. BitSight's core moat is a proprietary decade-plus internet-scanning dataset covering 40M+ organizations plus insurance and regulatory embedding, not just labor. It is automating its own questionnaire-review work via Framework Intelligence, launched August 2025, claiming over 99% task reduction rather than being displaced.
- Is BitSight laying off staff?
- Headcount fell roughly 19% from a 2023 peak of about 960 to 1,010 employees to around 730 to 800 by mid-2026, per Revelio Labs (2026-06-29) and Crustdata, which also flagged a further -2% year-over-year decline and falling web traffic in June 2026.
- Who is BitSight's biggest competitor?
- SecurityScorecard is BitSight's closest direct rival in cyber risk ratings, described as the largest competitor with A-F grading and 12M+ companies rated. Palo Alto Networks' Cortex Xpanse also competes in the adjacent exposure-discovery space as of July 2026.
- Is joining BitSight a safe career move in 2026?
- Mixed signal. BitSight is a Forrester Wave Q2 2026 Leader and Gartner 2026 Visionary with 3,500+ customers, but headcount has declined about 19% since its 2023 peak and a new CEO, John Clancy, only started April 7, 2026, with internal reports noting cross-team cohesion challenges.
Timeline
- 2026-06-25Bitsight partners with Factor as Premier Risk Intelligence Provider for AI-native supply-chain risk
- 2026-04-08Named Leader in Forrester Wave Cybersecurity Risk Ratings Platforms Q2 2026, top scores in 11 criteria
- 2026-04-07John Clancy appointed CEO, succeeding Steve Harvey who led the company 2020 to 2026
- 2026-04Named Visionary in 2026 Gartner Magic Quadrant for Cyber Threat Intelligence Technologies
- 2025-09-15Company reports Vendor Risk Management customers up 39% YoY, vendor network reaches 68,000 orgs
- 2025-08-05Launches AI-powered Framework Intelligence, automating compliance framework mapping
- 2025-01-20Begins rollout of Dynamic Remediation and next-gen scanning engine Groma
- 2024-12-12Closes $115M acquisition of Cybersixgill threat intelligence
- 2022-08Acquires ThirdPartyTrust
- 2021-09Moody's invests $250M for minority stake, valuing BitSight at $2.4B; acquires VisibleRisk
Revision history
21 July 2026
First assessed. Defensible for now. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- BitSight
- BitSight - Overview, News & Similar companies (2026-07-14)
- BitSight 2026 Company Profile
- BitSight Technologies Secures $24 Million Series A Financing (2013-06-04)
- BitSight Raises $250 Million at $2.4 Billion Valuation (2023-01-23)
- Valuation, Funding Rounds & Stock Price (2026-04-08)
- A New Chapter for Bitsight (2024-12-10)
- Bitsight Appoints John Clancy as Chief Executive Officer (2026-04-07)
- $200M ARR, $2.4B Valuation (2025-11-27)
- Bitsight vs. SecurityScorecard (2026-04-22)
- Enterprise Adoption of Bitsight's Integrated TPRM and Exposure Management Solutions Surges (2025-09-15)
- BitSight Number of Employees 2026 (2026-06-29)