
SecurityScorecard grades Hong Kong’s Security Bureau and departments poorly while authorities caution external scores may not reflect full security posture
A U.S.-based cybersecurity ratings agency has assigned low scores to the Hong Kong Special Administrative Region government, its Security Bureau and several departments, prompting a formal response from local authorities.
The ratings, reported by a prominent local newspaper, are based on the agency’s A-to-F grading system which monitors publicly visible indicators of security risk.
The watchdog noted that Hong Kong’s government entities were assessed on factors such as patching cadence, exposed internet-facing assets, DNS health and social engineering susceptibility — key categories within the agency’s methodology.
The local Digital Policy Office acknowledged the assessment, stating that while such external ratings offer “useful perspectives” they cannot fully reflect the range of internal information-security measures.
“Cybersecurity rating agencies may employ distinct methodologies, areas of focus and rating factors, often drawing on externally visible data,” the office said, noting that its subscription to the ratings service does not imply full endorsement of every rating.
It pointed out that public-domain metrics cannot capture internal controls, oversight, detection systems or incident-response capabilities.
The timing of the ratings coincides with heightened debate in Hong Kong over cybersecurity oversight, particularly after the government exempted itself from the city’s first anti-hacking legislation, which critics say raises questions about defence against threats targeting public infrastructure.
In its 2024 Cybersecurity Report, the Technology Crime and Cybersecurity Bureau noted over 33,900 technology crime cases, including 112 destructive cyber-attacks, though it did not link these directly to the government’s vulnerabilities.
Analysts say the low grades may prompt agencies to increase transparency around cyber-governance and address perceived gaps in external visibility.
Observers note that while such rating systems should not be taken as definitive, they often influence investor and vendor confidence, particularly in global supply-chain assessments.
With Hong Kong positioning itself as a digital-economy hub, improving third-party ratings may become a strategic priority for the Government.
The authorities have indicated they will review in-house communications on third-party cybersecurity tools and consider enhancing public-facing disclosures.
Implementation of the new Protection of Critical Infrastructure (Computer System) law, slated to take effect in 2026, may offer an opportunity to bolster the overall framework and improve performance in external assessments ahead of next year’s trading-hub review cycles.
The ratings, reported by a prominent local newspaper, are based on the agency’s A-to-F grading system which monitors publicly visible indicators of security risk.
The watchdog noted that Hong Kong’s government entities were assessed on factors such as patching cadence, exposed internet-facing assets, DNS health and social engineering susceptibility — key categories within the agency’s methodology.
The local Digital Policy Office acknowledged the assessment, stating that while such external ratings offer “useful perspectives” they cannot fully reflect the range of internal information-security measures.
“Cybersecurity rating agencies may employ distinct methodologies, areas of focus and rating factors, often drawing on externally visible data,” the office said, noting that its subscription to the ratings service does not imply full endorsement of every rating.
It pointed out that public-domain metrics cannot capture internal controls, oversight, detection systems or incident-response capabilities.
The timing of the ratings coincides with heightened debate in Hong Kong over cybersecurity oversight, particularly after the government exempted itself from the city’s first anti-hacking legislation, which critics say raises questions about defence against threats targeting public infrastructure.
In its 2024 Cybersecurity Report, the Technology Crime and Cybersecurity Bureau noted over 33,900 technology crime cases, including 112 destructive cyber-attacks, though it did not link these directly to the government’s vulnerabilities.
Analysts say the low grades may prompt agencies to increase transparency around cyber-governance and address perceived gaps in external visibility.
Observers note that while such rating systems should not be taken as definitive, they often influence investor and vendor confidence, particularly in global supply-chain assessments.
With Hong Kong positioning itself as a digital-economy hub, improving third-party ratings may become a strategic priority for the Government.
The authorities have indicated they will review in-house communications on third-party cybersecurity tools and consider enhancing public-facing disclosures.
Implementation of the new Protection of Critical Infrastructure (Computer System) law, slated to take effect in 2026, may offer an opportunity to bolster the overall framework and improve performance in external assessments ahead of next year’s trading-hub review cycles.







































