Shane
It was behind the times before it was released
I use Security Scorecard both for vendor evaluation and also as a user who attempts to maintain my own security posture of my web properties. Unfortunately, over time, I have found that SS is not really ready for the world of cloud and elasticity. The false positive rate on findings for companies who leverage cloud platforms with auto-scaling load balancers or server clusters is phenomenal. I have probably thousands of false positives. When trying to correct this issue, I am expected to go through thousands of IPs that are no longer associated with my devices and report that they're no longer assigned to me. One at a time. I've provided feedback but not really had an effective response, and my score and those of some of my vendors continues to drop due to false positives that cannot be scalably managed. It's a shame, because conceptually this is a good service/idea - it's just not implemented based on modern internet design principles.