2019 Client Recognition Award Program

Conducted every year since 2007, the Digital Defense Client Recognition Award Program recognizes organizations that displayed the highest level of network security throughout the previous calendar year based on their Frontline.Cloud™ vulnerability and remediation data.  Using Digital Defense’s proprietary Security GPA® scoring algorithm, awards are presented to recurring vulnerability management clients that had the highest Security GPA scores among their peers on their external and internal networks.  The following are the criteria surrounding the award program for 2019.

The following are eligibility requirements for the Client Recognition Award Program:

• Organizations must be a recurring Digital Defense client in good standing between January 1^st and December 31^st of the award year
• Clients must have been contracted for and conducted recurring full internal and external vulnerability scanning on at least a quarterly basis for the entire award year
• Clients must have full scan data for all four quarters of the award year
• The client network must be a ‘traditional’ network, comprised of a variety of typical device types observed on a typical network, such as servers, workstations, printers, etc.
• The client Active View™ must contain an average of at least 50 live devices throughout the year
• The client Active View must contain at least one live external device during each quarterly scoring cycle
• A client must not be intentionally or unintentionally abusing built in features of the Frontline.Cloud system, such as marking valid vulnerabilities as ‘false positive’, excluding a large number of hosts and/or ports from scanning or hiding hosts within Active View that may artificially inflate their Security GPA
• In cases where this is detected, the client may be disqualified or have its quarterly Security GPA recalculated based on the final full vulnerability scan of each quarter or historical Active View data, which will include any ‘hidden’ hosts and/or vulnerabilities
• As necessary, the Digital Defense EVP of Operations will independently assess any additional factors not identified above within a client’s scanning program in order to ensure common sense, consistency, and fairness are applied in confirming eligibility and identifying winning organizations within the Client Recognition Award Program

Once eligible clients are identified, award winners are determined by their Digital Defense Security GPA®.  Security GPA is an easy to understand security metric that is compiled from a combination of individual host grades based on results of recurring vulnerability assessments and penetration testing (if applicable), and standardized system criticality ratings. Security GPA scores are pulled for all clients on a quarterly basis throughout the award year and are based upon vulnerabilities discovered only via non-authenticated methods.  This allows our clients who are more proactive in running recurring authenticated scans (thereby finding more vulnerabilities and causing a lower Security GPA) to have an apples-to-apples Security GPA comparison against clients who choose not to run authenticated scans.

The quarterly Security GPA scores are then averaged using a weighting system based on the recency of the Security GPA scores, with the more recent scores weighing heavier into the final average. Once the ‘annualized’ Security GPA is determined for the internal and external networks, small adjustments/bonuses are applied based on the following criteria:

• Network Size (+0.01 per 100 hosts internally / +0.01 per 10 hosts externally – up to +0.10 points for each network location score)
• Penetration Testing (must be conducted by Digital Defense) (+0.10 for internal and external penetration testing – up to +0.10 points for each network location score)
• Managed Services (+0.0125 per quarter in which contracted, applied both internally and externally)
• Contracted Frequency of Scanning (+0.0125 internally and externally per quarter for on-demand and monthly scanning)
• Authenticated Scanning (+0.025 internally during each quarter that a network-wide authenticated vulnerability scan(s) was executed)

After the above adjustments/bonuses are applied to the ’annualized’ Security GPA, clients must have at least a 3.50 Security GPA on their internal and external networks to qualify for an award.  Once qualifying clients have been identified, the internal and external Security GPA scores are averaged and this score is used to rank the qualifiers to determine the awards.

The following are the defined awards as part of the Client Recognition Award Program:

• Best Overall Network Security Program – A trophy is awarded to the client with the highest composite Security GPA (the average of internal and external annualized Security GPAs after bonus/adjustment added) of all Digital Defense clients within its category. The three categories for this award are:
  • Large Network (1000+ live hosts)
  • Midsize Network (250-999 live hosts)
  • Small Network (50-249 live hosts)

The DDI Chief Executive Officer or his designee travels to the client’s location, at no cost to the client, for a trophy presentation at a function of the client’s choosing.

• Excellence in Network Security Award - Awarded to clients who have an annualized Security GPA of 3.50 or higher on their internal and external networks and the average of those Security GPAs places them within the 98^th percentile of all of Digital Defense’s recurring vulnerability scanning clients, regardless of their network size category. These clients are awarded a plaque and receive a congratulatory letter from the Digital Defense President & CEO.  These awards are typically shipped via FedEx or U.S. Mail, although they are awarded in person in some instances.

• Honorable Mention – Clients with at least a 3.50 composite Security GPA internally and externally but do not place within the 98^th percentile will receive an Honorable Mention certificate and a congratulatory letter from the Digital Defense President & CEO.