Methodology
How Entropy scores vendors
Every vendor in the directory is scored against a versioned rubric — four categories worth 100 points, plus a small capped verification bonus. Scores are computed from publicly observable signals and independently verified certifications — no vendor self-reporting, no marketing copy. Grades reflect what can actually be verified.
What these signals measure
Entropy measures observable security hygiene and organizational transparency practices — not the internal code of an AI product. This is a deliberate and defensible choice.
Security researchers have long recognized that observable practices are meaningful proxies for security culture. Companies that implement responsible disclosure programs, maintain credential hygiene, and publish security transparency artifacts are demonstrably more likely to invest in the security practices CISOs can't directly audit: secure development processes, internal access controls, and incident response maturity.
The automated signals are the first layer — security hygiene, whether a model card is published, and which certifications a vendor names. The governance and AI-certification points only unlock once a certification has been independently verified: a claimed vendor uploads the report for an admin to review, or an admin confirms it against a registry. That verification step is where the deeper, higher-confidence picture comes from.
Key principle
Grades are computed against a fixed 100-point rubric. Security hygiene alone is worth 75 of that 100, so a company with flawless observable hygiene and nothing else scores 75/100 — C. Hygiene is the foundation, not the ceiling: governance, AI-safety and a clean incident record are what lift a vendor above it.
Grade scale
The standard plus/minus scale, applied to the 100-point rubric score. Thresholds are versioned and published with the rubric version.
Verified potential score
Every company profile shows a current grade (automated scan only) and a potential grade (what they could achieve by claiming their profile).
The verification bonus is worth up to +5 pts — 3 for confirming domain ownership by claiming the profile, and 2 for getting an uploaded evidence document admin-verified. It is capped and additive: it lifts the final score but not the grade denominator, so an unclaimed vendor is never penalised. It gives vendors a clear, actionable path to improve their grade, and the claim portion applies within minutes rather than waiting for the weekly rescan.
Category benchmark
Each profile shows a relative benchmark — "Top 23% of AI vendors measured" — alongside the absolute grade.
This tells you where a vendor sits relative to their peers in the same category, independent of the absolute grade scale. It's a useful signal for procurement decisions: even if most vendors in a category score D+, knowing which one scores in the top 10% is actionable information.
Scoring categories
Security hygiene & transparency
75 pts maxObservable security practices on the vendor's public domain. These are proven proxies for organizational security culture — not direct audits of product code. Companies that implement responsible disclosure, security headers, and keep a public trust page demonstrate security-aware culture at the organizational level. This is the largest category — 75 of the 100 points — and it is fully automated.
Governance
14 pts maxIndependently verified compliance certifications, weighted by how transparent the disclosure is. A certification only scores once it has been verified — either a claimed vendor uploaded the underlying report and an Entropy admin reviewed it, or an admin independently confirmed it against a real registry or with the issuing firm. Uploading a document by itself earns no points until that admin review happens. A certification merely named on a vendor's public trust page also earns nothing on its own: a plain-text scan can't reliably tell "we hold this" from "we don't", so an unconfirmed mention is never worth points. Certifications that don't apply to a vendor's market (FedRAMP for a company with no government customers, HIPAA for one that never touches health data) are left out of both the numerator and the denominator, so their absence never counts against the score. Anyone can flag a certification that looks wrong.
AI safety practices
8 pts max · 5 liveWhether the vendor publishes meaningful transparency artifacts about their models, and whether they hold an AI-management-system certification. Marketing copy doesn't count — a model card has to actually document limitations and intended use.
Incident history
3 pts maxA company with no recorded security incident scores full marks here — this is a good-faith default, not a reward you have to earn. A recorded incident is a temporary drag whose size depends on severity and how well the company disclosed and remediated it, and which decays back to zero over 24 months. It is never a permanent mark and never an automatic zero-out. Incidents are recorded by Entropy administrators from public reporting.
Verification bonus
5 pts max · bonusA small set of bonus points for vendor engagement that can't be automated: verifying domain ownership by claiming the profile, and getting an uploaded evidence document admin-verified. Bonus points are capped and additive — they lift the final score but not the grade denominator, so an unclaimed vendor is never penalised — and the claim bonus applies within minutes, not just on the weekly rescan.
Reading a certification gap
Why doesn't every vendor have every certification?
A vendor with a missing certification isn't automatically a weaker choice. Certifications differ in what they cover, how long they take to earn, and who they even apply to — so the same blank entry can mean very different things depending on the standard.
SOC 2. An independent auditor's report on a company's security controls. The Type II report most enterprise buyers ask for assesses how controls operated over an observation window of several months to a year, so it can't be produced on demand: published industry breakdowns put the end-to-end effort at roughly 6–12 months or more, with audit costs that run into the tens of thousands and up depending on company size and auditor (Drata, Secureframe). A company that is a couple of years old and sells mostly to small businesses may simply not have reached the point where a customer required one. The learn guide covers this in more detail.
HIPAA. A U.S. law rather than a certification. Its Privacy and Security Rules bind “covered entities” — health plans, most healthcare providers, and clearinghouses — and the business associates that handle protected health information on their behalf (HHS.gov). A vendor that never touches health data has no obligation under HIPAA and no reason to seek an attestation, so its absence on a general-purpose tool is expected rather than a gap.
FedRAMP High, GovRAMP, IRAP, PCI DSS, TISAX, DORA. These have narrower, well-defined audiences rather than being broadly relevant the way the standards above are. FedRAMP High (FedRAMP) and GovRAMP (GovRAMP) apply mainly to vendors selling cloud services to U.S. federal and state/local government agencies respectively; IRAP (ACSC) is the Australian government's equivalent. PCI DSS (PCI SSC) applies to a vendor that directly stores, processes, or transmits payment card data — one that routes payments through a processor like Stripe usually doesn't need it itself. TISAX (ENX) is specific to the European automotive supply chain, and DORA (European Commission) is an EU regulation for financial-sector ICT risk management. A vendor outside all of these markets has no reason to hold the corresponding certification — an Entropy admin marks which ones genuinely apply to a given vendor, and only those count toward, or against, its Governance score.
ISO 27001. The international standard for information security management systems. Certification is an audited process that takes months to reach and is renewed on a three-year cycle with annual surveillance audits. It is most common among companies selling into large enterprises or European markets, where it is frequently contractually required; a capable vendor whose buyers don't ask for it often hasn't pursued it (ISO).
ISO 42001. The international standard for AI management systems, published in December 2023 (ISO). It is newer than the others by years, and the number of certified organizations is still very small. For now, its absence tells you little; its presence is a strong early signal.
Entropy's rubric separates holding a certification from having it independently verified. The Governance category only awards points for a certification once an Entropy admin has confirmed it or reviewed the underlying report — so a low governance score on a young company usually means “not verified yet,” not “evasive.” The bulk of a grade comes from security hygiene, which is fully automated and doesn't depend on any certification at all. See reading your own Entropy score and the Governance category above.
Rubric versioning
Every score document records the rubric version it was computed against. This means historical scores remain comparable even as the rubric evolves — you can always know whether a score was computed before or after a methodology change. The current rubric is v2.0.0. Grade thresholds are also versioned — changes to thresholds are announced with the rubric version and applied only to new scans, not retroactively.