Comparison
PuReAI vs Bitsight (2026)
Bitsight is a security ratings incumbent with a very large observed-asset dataset. PuReAI is a domain-centric OSINT and threat intelligence platform with a published scoring formula and a sovereign deployment option.
Last reviewed: 2026-09-01
How the two are positioned
Both produce an external risk score for your organisation and your suppliers. The difference is what you can see behind the number and where the platform runs.
Side by side
| Dimension | PuReAI | Bitsight |
|---|---|---|
| Scoring transparency | Formula and segment weights published: Compromises 0.4, Issues 0.3, Supply Chain 0.2, Exposure 0.1. | Ratings methodology documented at a category level across 25 risk vectors; the exact weighting model is proprietary. |
| Deployment | Cloud or sovereign/on-premise deployment for entities with data residency constraints, including an air-gapped option. | Vendor-hosted SaaS platform, delivered as a cloud service. |
| Portfolio scale | Built for focused supplier portfolios and deep per-domain analysis. | Very large pre-rated company universe, strong for wide portfolio benchmarking. |
| Threat intelligence | Ransomware actor tracking and MITRE ATT&CK TTPs correlated to your sector, queryable in a graph with natural language. | Ratings-centric, with observed C2, malware, DDoS and scanning behaviour as inputs to the rating rather than a separate actor graph. |
| Dispute process | In-platform dispute, analyst review of raw evidence, outcome within 5 business days, rule fixed for all customers. | Formal rating dispute process available to rated entities through the Bitsight platform. |
| Score cadence | Continuous, with score history showing degradation between reviews. | Daily security ratings computed from a rolling window of supporting data. |
| Score format | 0-100 numeric score with four weighted segments shown separately. | Numeric rating on a 250-900 scale, comparable to a credit-score style range. |
| Data residency control | Customer chooses where the platform and its data reside. | Data processed and hosted in Bitsight's own cloud infrastructure. |
| Primary buyer motion | Free domain report, then a scoped engagement. | Free risk report, then enterprise subscription. |
Based on each vendor's publicly documented product information. If something here is out of date, tell us and we will correct it.
A closer look
Overview
PuReAI
PuReAI is a cyber risk intelligence platform built around continuous, passive OSINT collection on a domain and its supply chain. It produces a single Company Risk Score from four published segments, plus a threat graph that ties findings to known ransomware actors and MITRE ATT&CK techniques relevant to the target's sector and technology stack. The platform is designed for teams that need to explain a score line by line, whether to their own board, to a regulator, or back to the supplier being scored. It is aimed at organisations running focused third-party risk programmes where each supplier relationship is significant enough to justify evidence-level review rather than a portfolio-wide letter grade. Because the collection is entirely external and passive, no credentials, agents or supplier cooperation are required to start scoring a domain, and results are available from the first scan rather than after an onboarding cycle.
Bitsight
Bitsight is one of the longest-established security ratings vendors, founded to bring transparency to outside-in cybersecurity measurement. Its ratings are built from behavioural evidence such as botnet communication, malware distribution, spam propagation and misconfigured infrastructure, aggregated across roughly 25 risk vectors into a single 250-900 rating, refreshed daily. Bitsight rates a very large number of organisations globally, which makes it well suited to benchmarking a large portfolio of suppliers or an industry peer set out of the box. Its public documentation describes the rating as intended for board-level and procurement conversations, insurance underwriting and vendor risk management programmes, with a defined methodology white paper describing category weighting logic without disclosing the underlying statistical model in full.
Deployment options
PuReAI
PuReAI can run as a managed cloud service or be deployed inside the customer's own infrastructure, including an air-gapped configuration for environments where no external network path is permitted. This matters for regulated entities, government-adjacent organisations, and companies operating under data residency rules that restrict where risk telemetry about their own domain and suppliers can be processed or stored. The deployment model is a procurement decision made once, not a limitation baked into the architecture; the same scoring engine, weightings and modules are available in both modes. For organisations that cannot send supplier and internal domain data to a third-party's shared cloud, on-premise deployment removes that constraint entirely while keeping the published scoring formula unchanged.
Bitsight
Bitsight is delivered exclusively as a vendor-hosted SaaS platform, accessed through Bitsight's own cloud infrastructure and portal. There is no documented option on Bitsight's public site for customers to run the ratings engine, or their organisation's rated data, inside their own on-premise or air-gapped environment. This is a common model for ratings vendors and works well for most commercial use cases, since customers are consuming a rating rather than raw collection infrastructure. It does mean that any customer with a strict data-sovereignty or air-gapped procurement requirement is constrained to whatever region and hosting terms Bitsight publishes, rather than choosing where the workload runs.
Scoring transparency
PuReAI
PuReAI publishes its scoring formula in full: Compromises weighted at 0.4, Issues at 0.3, Supply Chain at 0.2 and Exposure at 0.1, combined into a single 0-100 Company Risk Score. Each finding is mapped to exactly one segment, so a supplier or internal stakeholder disputing a score can see precisely which segment it affected and by how much, rather than being told only that a category changed. The same fixed formula applies to every customer and every scored domain; there is no custom weighting negotiated per account. This is intended to make the score defensible in a regulatory or contractual context: an auditor can be shown not just the number but the arithmetic that produced it, using a methodology page that is publicly accessible rather than gated behind a sales conversation.
Bitsight
Bitsight documents its methodology publicly through a detailed white paper and knowledge base articles describing 25 risk vectors grouped into categories such as compromised systems, diligence, user behaviour and public disclosures, each contributing to the overall rating. Bitsight states that ratings are calculated using a data-driven, outside-in approach based on daily-refreshed evidence, and that its Policy Review Board oversees the methodology. However, the exact statistical weighting applied across the 25 vectors, and how they combine into the final 250-900 score, is described conceptually rather than published as an explicit formula. Rated organisations can view their own vector-level detail inside the platform, and can raise disputes on individual findings through Bitsight's documented dispute process.
Data collection
PuReAI
Collection is entirely passive and external: DNS, certificate, banner, port, breach-corpus, code-repository and document sources are gathered without touching the target's infrastructure, requiring no credentials, no agents and no authentication. Every finding stores the raw artefact behind it, such as the specific DNS record, certificate chain or exposed banner, so an analyst can inspect the evidence rather than trust a label. Findings that are inferred rather than directly observed, such as a vulnerability inferred from a version banner, are explicitly flagged as inferred so they are not treated with the same confidence as a directly confirmed exposure.
Bitsight
Bitsight collects observable, outside-in signals from its own global sensor network and third-party data sources, including sinkholes and honeypots that observe communication attributable to an organisation's IP space, alongside configuration and hygiene checks such as SSL certificate validity, patching cadence and open ports. Bitsight's public documentation describes this as a passive, non-intrusive collection model that does not require access to a rated company's internal network. Ratings update on a daily cycle as new evidence is observed, and Bitsight attributes network behaviour to organisations using its own internet mapping methodology.
Coverage
PuReAI
Coverage depth is prioritised over sheer count: each scored domain receives per-domain OSINT across the platform's twelve modules, plus supply-chain mapping to identify dependencies and third-party technology that were not explicitly declared by the customer. This suits programmes where the supplier list is known and the requirement is to go deep on each one, including into subsidiaries, forgotten subdomains and shadow-IT assets tied to the same organisation.
Bitsight
Bitsight maintains ratings on a very large number of companies worldwide, built up over more than a decade of internet-wide observation, which means many organisations already have a Bitsight rating available before a customer ever requests one. This breadth is one of Bitsight's most cited strengths on its own site, supporting use cases like instant benchmarking of an entire supplier portfolio or an industry peer set without waiting for a new domain to be onboarded.
Integrations
PuReAI
PuReAI integrates with common security and IT workflow tools including Splunk, Sentinel, Jira, ServiceNow and Slack, plus a webhook and REST API for custom pipelines, so findings and score changes can be routed into whatever ticketing or SIEM workflow a team already runs, in either the cloud or on-premise deployment mode.
Bitsight
Bitsight publishes integrations with common GRC, SIEM and ticketing tools, including connectors referenced in its product documentation for platforms such as ServiceNow and ecosystem partners in cyber insurance and risk management. As a SaaS platform, all integrations run against Bitsight's cloud-hosted API and portal rather than a customer-controlled deployment.
Pricing model
PuReAI
PuReAI starts with a free domain report that anyone can request, with paid engagements scoped to the number of monitored domains, suppliers and modules required, and priced differently depending on whether the deployment is cloud or on-premise. Commercial terms are not published as a fixed price list, consistent with a platform that varies by deployment mode and portfolio size.
Bitsight
Bitsight offers a free risk report as an entry point, converting into an enterprise subscription. Bitsight does not publish a fixed public price list on its site; pricing is quoted per engagement based on the number of monitored entities and modules purchased, consistent with typical enterprise security ratings commercial models.
Support
PuReAI
Customers get access to analyst review as part of the dispute process, with raw evidence reviewed by a human analyst and a fixed resolution window of five business days applied consistently across the customer base, alongside standard account and technical support.
Bitsight
Bitsight provides a formal rating dispute mechanism for rated organisations along with a public knowledge base and standard customer support channels documented on its help site, consistent with an established enterprise SaaS vendor.
Which one fits your situation
Choose PuReAI when
- — You must justify every point of a supplier's score to a regulator or to the supplier itself.
- — Data residency or sovereign deployment is a procurement requirement.
- — You want actor-level threat context, not only a rating.
Choose Bitsight when
- — You need instant pre-rated coverage across thousands of companies for benchmarking.
- — Your programme is already built around Bitsight ratings in contracts.
Questions we get asked
Is PuReAI a security ratings provider?
Partly. It produces a Company Risk Score like a ratings provider, but it is built around deep per-domain OSINT and threat intelligence rather than a pre-rated universe.
Can PuReAI run alongside Bitsight?
Yes. Teams commonly use a ratings feed for breadth and PuReAI for depth and evidence on the suppliers that matter most.
Can Bitsight be deployed on-premise?
Bitsight's public documentation describes it as a cloud-hosted SaaS platform; it does not publish an on-premise or air-gapped deployment option, unlike PuReAI.
Compare on your own domain
Run a free PuReAI domain report and check it against whatever you use today. The scoring methodology is public.