Orpheus Cyber

Orpheus Cyber sells the product most like a classic security rating: a score per organisation, backed by threat intelligence, covering your own perimeter and your third parties. The homepage states that its scores are validated by Gallagher Re as predictive of real-world cyber claims, which is a claim by the vendor and not something we tested.

The operating company is Orpheus Cyber Limited, registered in England and Wales with its office at 34 Lime Street, London. Its website terms are governed by English law.

Scores for you and your suppliers

The third-party module monitors the attack surfaces of your suppliers and shows them in a heat map, with new third parties onboarded through the portal. The same portal covers your own external attack surface, with shadow IT discovery and prioritised issues.

A separate security questionnaire module and a cyber insurance offer sit next to the scoring, so the same data can serve procurement, risk and insurance conversations.

Vulnerability scoring with its own model

The risk-based vulnerability management module uses the Orpheus Vulnerability Severity Score (OVSS), which the vendor says updates in real time using machine learning and threat intelligence to predict exploitation.

Regulatory mapping

The vendor lists regulatory compliance support that maps DORA, NIS2 and ISO 27001 to risk evidence from the platform and tracks remediation.

Limitations to Consider

Pricing is not published and the pages checked do not state where the portal data is hosted. The company is smaller than the US rating vendors, so the supplier coverage you get should be tested in the free trial. For a deeper picture of your own exposure, Hadrian or CybelAngel go further into validation and leaked data.

Who Should Use Orpheus Cyber

Risk, procurement and insurance teams in Europe that want supplier cyber risk scores from a British vendor.