A group does not have a score. It has a distribution.
The natural question from anyone who controls several entities is what the group's number is. There isn't one: exposure does not add up, nor can it be computed as a revenue-weighted average. What does exist, and is more useful, is the distribution across entities, who sits at the extremes, and where dispersion shows governance has not reached evenly.
Allocating attention and capital across entities of the same group, or assessing a portfolio of holdings, without a metric that can be compared across them.
What is at stake
The operational ruler positions each entity against its own sector cohort, which matters in diversified groups: a technology subsidiary and a healthcare one should not be compared to each other by absolute score, because the data shelf-life priors entering the calculation differ by construction.
- Source
- IEQ publication used by the products, sector aggregates
- Date
- October 7, 2026
- Population
- 80,182 companies in the publication used by the products
- Coverage
- Public layer only: DNS, TLS, PQC readiness, headers, infrastructure, and observable subdomains.
Limitation. Sector percentiles make entities from different sectors comparable in relative position, not in absolute score. The group's consolidated view remains a distribution, not a single number.
Portfolio is the scope of the question, not a separate product.
Score, dimensions, and contributors for each entity, in the same collection window.
Each entity positioned against its own sector cohort, not against its siblings.
How the group distributes across bands, and how far the extremes sit from the internal median.
A consolidated PDF readout, with the distribution and comparability caveats.
A distribution readout, not a consolidated figure.
What you receive
- Score and band for each entity, with the shared cutoff date.
- Each entity's percentile against its own sector.
- The group's distribution across risk bands.
- Internal dispersion and identification of the extremes.
- Recurring contributors: what shows up across several entities.
- A consolidated analytical report, with comparability caveats.
See the method's limits, the dependencies and where measurement ends
Why there is no single group number
Consolidating exposure into a single value would require an aggregation rule the methodology does not define, and inventing one to fit a slide would be exactly the kind of number that does not survive a question.
Observed
Public collection saw
- Each entity's public surface, collected identically.
- Signals shared across entities of the same group.
Calculated
The IEQ engine derived
- Score and dimensions per entity.
- Sector percentile and band for each.
- Dispersion across the set.
Inferred
The model estimated
- Each entity's sector, when not declared.
- Shared infrastructure relationships between entities.
Out of scope
Other evidence decides
- A consolidated group score.
- That a subsidiary's exposure transfers to the parent.
- Direct comparison of absolute scores across different sectors.
- Valuation, credit risk, or estimated financial impact.
What it depends on
- A list of entities with each one's domains.
- A declared sector per entity, when the detected one is not sufficient.
- Collection in the same window for the entire portfolio.
Boundary
Measurement ends at the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries. That work is carried out by the organization's own teams and suppliers. After the change, GWK re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.
Why measuring does not reduce exposureBring the portfolio structure
Entities, domains, and sectors. With that, the readout comes out in the same window for the whole portfolio, which is the condition for the distribution to mean anything.