[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Why CEO Approval Ratings Matter for Risk Assessments](/blog/why-ceo-approval-matters-for-security-ratings) Publish date November 19, 2024 {x} minute read # Why CEO Approval Ratings Matter for Risk Assessments [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/vendor-risk-assessment-template) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Template Vendor Risk Assessment Template Free resource ### Vendor Risk Assessment Template [Download now](/resources/vendor-risk-assessment-template) Our new digital reputation scan provides a fast and easy way to get a risk assessment for your (or any) business. We look at the same stuff that other external risk assessment tools do– [SSL](/blog/ssl-certificate) configurations, breach history, SPF records and other domain authenticity markers, blacklists and [malware](/blog/malware) activity. We're happy to offer this service for free, because that information is public and we believe that it's what's inside that really matters. Most of the elements we include in our external assessment are not controversial, but one resulted in arguments lasting several days: the CEO approval rating. In selecting which checks would go into our risk assessment, we here at [UpGuard](/) looked at similar site assessment tools and selected only the checks that we thought were relevant to our goal: risk assessment, which overlaps with, but isn't identical to, website best practices. Plus, there are already fine tools for performing those best practices functions, so why duplicate them? We also intentionally omitted checks we thought would not be significant for calculating the risk of data breach and the damage it would cause. [Download your vendor risk assessment template >](https://www.upguard.com/resources/vendor-risk-assessment-template) As the digital economy has matured, so has the recognition that cyber risk cannot be eliminated; it must be managed.  On the other hand, we chose to include information that is outside the scope of a technical assessment, but which is profoundly important for assessing risk. Headquarters location, market capitalization, revenue, number of employees: these are all factors that contribute to the risk of a breach and how damaging that breach would be. Breach history, similarly, is not something that you can change by editing a configuration file or buying a certificate, but it is part of the set of facts that deserve to be considered when determining the risk posed by a given property. We included CEO approval rating for the same reason.\ \ As Ashley Madison and Edward Snowden have reminded the world, insider activity is still a very real cause of data breaches. How can we assess the likelihood of a secretive attack by a privileged individual? It seems to follow that employees who feel a sense of loyalty to their company and who believe in its mission will be less likely to harm it intentionally. Vice versa, those who really don't like their employer will be more inclined to harm it. Even unintentional harm caused by circumventing security policies can be attributed in part to whether an employee believes in the leadership. One's feeling about the CEO, as well as senior management more generally and the job itself, all provide insight into a critical [vector](/blog/attack-vector) for the loss of data confidentiality. That's the case for including this particular check. The case against including CEO approval and employee satisfaction information is that those feelings are subjective and potentially skewed by angry employees. We pull our data from Glassdoor, and at small companies you will often get a disproportionately rosy picture when the only reviews are from the first five employees. For that reason, we include the number of reviews in the risk scan to make it apparent when this is happening. But what's really frustrating for an IT or security manager is that this is a problem they can't fix. Github, a site we and millions of other developers use, has impeccable security controls and a lousy CEO rating. Unlike technical risks, which have the pleasing simplicity of being either present or not and have a logical path to resolution, risks posed by human subjectivity are inherently messy, probabilistic, and without a known solution.\ \ Unfortunately, that's just how it is with [information security](/blog/information-security). The adversaries are humans, which means behavior is not strictly deterministic. Only checking factors that have a reassuringly Boolean value does a disservice to our scoring and to the people who use it. Just as one might fall into a risk class that seems unfair– for example, paying more for car insurance as a single young man when you *know* you drive more safely than your friends– is a necessary evil of using data to price risk. The good news is that we are trying to make it possible for companies to demonstrate that they have a lower risk than is externally apparent through our [digital reputation assessment](https://webscan.upguard.com/). Just as a car insurance company might allow young drivers to lower their rates by demonstrating safe practices, we provide an assessment to show that internal systems are sufficiently hardened to counter the appearance of external risks.\ \ Long story short: the CEO approval rating has stayed. If senior leadership are serious about becoming digitally resilient, it's not something they can just push down to Security and Ops. Everyone needs to be on board. Template Vendor Risk Assessment Template Free resource ### Vendor Risk Assessment Template [Download now](/resources/vendor-risk-assessment-template) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)