What is the official website of Zip ?

The official website of Zip is https://ziphq.com.

What is Zip's cybersecurity risk score?

Zip has an AI-generated cybersecurity risk score of 758 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has Zip experienced?

According to Rankiteo, Zip currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Zip been affected by any supply chain cyber incidents ?

According to Rankiteo, Zip has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does Zip have SOC 2 Type 1 certification ?

According to Rankiteo, Zip is not certified under SOC 2 Type 1.

Does Zip have SOC 2 Type 2 certification ?

According to Rankiteo, Zip does not hold a SOC 2 Type 2 certification.

Does Zip comply with GDPR ?

According to Rankiteo, Zip is not listed as GDPR compliant.

Does Zip have PCI DSS certification ?

According to Rankiteo, Zip does not currently maintain PCI DSS compliance.

Does Zip comply with HIPAA ?

According to Rankiteo, Zip is not compliant with HIPAA regulations.

Does Zip have ISO 27001 certification ?

According to Rankiteo,Zip is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Zip operate in ?

Zip operates primarily in the Software Development industry.

How many employees does Zip have ?

Zip employs approximately 1,156 people worldwide.

Does Zip own any subsidiaries ?

Zip presently has no subsidiaries across any sectors.

How many LinkedIn followers does Zip have ?

Zip's official LinkedIn profile has approximately 44,744 followers.

What is the NAICS classification code for Zip ?

Zip is classified under the NAICS code 5112, which corresponds to Software Publishers.

Does Zip have a Crunchbase profile ?

No, Zip does not have a profile on Crunchbase.

Does Zip have a LinkedIn profile ?

Yes, Zip maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/theziphq.

How many cybersecurity incidents has Zip experienced ?

As of August 12, 2026, Rankiteo reports that Zip has experienced 1 cybersecurity incidents.

How many peer or competitor companies does Zip have ?

Zip has an estimated 30,603 peer or competitor companies worldwide.

What types of cybersecurity incidents has Zip faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

Zip

Boost Score +25 with badge (5 left)

758

/1000

Fair

783

/1000

Fair

Zip Vendor Cyber Rating & Cyber Score

ziphq.com

Add Your Compliance Badge

Zip is the world’s leading AI-powered procurement orchestration platform, empowering businesses to accelerate the procurement process, mitigate risk, and drive growth by offering a single front door to unify the teams, tasks, and tools involved in working with suppliers. With Zip, businesses can maximize employee adoption of purchasing policies and increase spend visibility and control. As the leading solution for optimizing business spend, Zip’s AI-powered platform is trusted by hundreds of leading enterprises worldwide, including AMD, Anthropic, Arm, Canva, Coinbase, Discover, Dollar Tree, HP, Instacart, Lyft, Northwestern Mutual, Pinterest, Prudential, Reddit, Sephora, Snowflake, Sprouts Farmers Market, and Toast to maximize the ROI of

Zip A.I CyberSecurity Scoring

Scoring History

Zip

Zip CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Zip

Vulnerability

7/2025

THE520205211202...

Loading…

A.I.

Zip Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for Zip

Incidents vs Software Development Industry Avg (This Year)

No incidents recorded for Zip in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Zip in 2026.

Incident Types Zip vs Software Development Industry Avg (This Year)

No incidents recorded for Zip in 2026.

Incident History - Zip (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Zip Subsidiaries

Parent Company

Zip

Software Development

Website: https://ziphq.com

Company Size: 501-1,000 employees

No subsidiary data available for this company.

Loading…

Zip Similar Companies

Instacart

cb instacart.com

Instacart, the leading grocery technology company in North America, works with grocers and retailers to transform how people shop. The company partners with more than 1,500 national, regional, and local retail banners to facilitate online shopping, delivery and pickup services from more than 85,000 stores across North America on the Instacart Marketplace. Instacart makes it possible for millions of people to get the groceries they need from the retailers they love, and for approximately 600,000 Instacart shoppers to earn by picking, packing and delivering orders on their own flexible schedule. The Instacart Platform offers retailers a suite of enterprise-grade technology products and services to power their e-commerce experiences, fulfill orders, digitize brick-and-mortar stores, provide advertising services, and glean insights. With Instacart Ads, thousands of CPG brands – from category leaders to emerging brands – partner with the company to connect directly with consumers online, right at the point of purchase. With Instacart Health, the company is providing tools to increase nutrition security, make healthy choices easier for consumers, and expand the role that food can play in improving health outcomes. For more information, visit www.instacart.com/company.

Trimble Inc.

trimble.com

Trimble is a global technology company that connects the physical and digital worlds, transforming the ways work gets done. With relentless innovation in precise positioning, modeling and data analytics, Trimble enables essential industries including construction, geospatial and transportation. Whether it's helping customers build and maintain infrastructure, design and construct buildings, optimize global supply chains or map the world, Trimble is at the forefront, driving productivity and progress. For more information about Trimble (Nasdaq: TRMB), visit: www.trimble.com.

PhonePe

cb phonepe.com

PhonePe Group is India’s leading fintech company, proudly recognized as India’s #1 Trusted Digital Payments* Brand for three consecutive years. Our flagship product, the PhonePe app was launched in August 2016, has rapidly become the preferred consumer payments app in India. In just eight years, PhonePe has gained over 57 crore + registered users and established a digital payments acceptance network of over 4 crore+ merchants spread across Tier 2,3 cites and beyond, covering 99% of the postal codes in the country. Building on our leadership in digital payments, PhonePe Group has expanded into financial services—including insurance, lending, and wealth management—along with new consumer tech ventures such as Pincode, a hyperlocal ecommerce platform, Indus App Store - India’s first localized app store, and Share.Market- A wealth and investment platform (app & website), catering to investors and traders needs. Headquartered in India, PhonePe Group aligns its diverse portfolio of businesses with our vision We're committed to empowering every Indian by unlocking the flow of money and providing equal access to easy & secure payments and financial services.

IGT

IGT.com

IGT is a leading global provider of gaming, digital and financial technology solutions, formed through the combination of International Game Technology PLC’s Gaming & Digital Business and Everi Holdings Inc. IGT’s offering spans gaming machines, game content and systems, iGaming, sports betting, cash access, loyalty and player engagement solutions, enabling it to deliver integrated, customer-centric experiences across land-based and digital environments. Organized into Gaming, Digital and FinTech business units, IGT drives innovation, efficiency and value for casino, digital and hospitality operators worldwide. The company is headquartered in Las Vegas.

ByteDance

bytedance.com

ByteDance is a global incubator of platforms at the cutting edge of commerce, content, entertainment and enterprise services - over 2.5bn people interact with ByteDance products including TikTok. Creation is the core of ByteDance's purpose. Our products are built to help imaginations thrive. This is doubly true of the teams that make our innovations possible. Together, we inspire creativity and enrich life - a mission we aim towards achieving every day. At ByteDance, we create together and grow together. That's how we drive impact - for ourselves, our company, and the users we serve. We are committed to building a safe, healthy and positive online environment for all our users. We have over 110,000 employees based in more than 30 countries globally. Join us.

Databricks

databricks.com

Databricks is the Data and AI company. More than 20,000 organizations worldwide — including adidas, AT&T, Bayer, Block, Mastercard, Rivian, Unilever, and over 60% of the Fortune 500 — rely on Databricks to build and scale data and AI apps, analytics and agents. Headquartered in San Francisco with 30+ offices around the globe, Databricks offers a unified Data Intelligence Platform that includes Agent Bricks, Lakeflow, Lakehouse, Lakebase and Unity Catalog. --- Databricks applicants Please apply through our official Careers page at databricks.com/company/careers. All official communication from Databricks will come from email addresses ending with @databricks.com or @goodtime.io (our meeting tool).

Meituan

meituan.com

Adhering to the ‘Retail + Technology’ strategy, Meituan commits to its mission that 'We help people eat better, live better'. Since its establishment in March 2010, Meituan has advanced the digital upgrading of services and goods retail on both supply and demand sides. Together with our partners we provide quality services for consumers. On 20 September, 2018, Meituan was listed on the Main Board of the Stock Exchange of Hong Kong. Meituan has always put customers first, and continuously increased its R&D investment in new technologies. Meituan will join hands with all partners to fulfill our social responsibility and create more values for the society.

Daraz

cb daraz.com

Founded in 2015, Daraz is the leading e-commerce platform in South Asia with operations in Pakistan, Bangladesh, Sri Lanka, Nepal, and Myanmar. It provides sellers and consumers with cutting-edge marketplace technology, targeting a rapidly growing region of over 500 million people. By building an integrated infrastructure covering e-commerce, logistics, payment and financial services, the company aims to deliver an immersive, personalized shopping experience and uplift South Asian communities through the power of commerce. Daraz has consistently invested in building an e-commerce ecosystem in South Asia through advancements in technology, logistics and digital payments. As digital penetration and consumer awareness have surged, the region is now ready for a transformative leap. Leveraging new-age advancements such as AI, Daraz is poised to further enhance the platform’s efficiency to enable a seamless experience for its consumers and sellers. Visit https://www.daraz.com/ to learn more.

Nielsen

cb nlsn.co

Nielsen shapes the world’s media and content as a global leader in audience insights, data and analytics. Through our understanding of people and their behaviors across all channels and platforms, we empower our clients with independent and actionable intelligence so they can connect and engage with their audiences—now and into the future. Nielsen operates around the world in more than 55 countries. Learn more at http://nlsn.co/6006JMfty and connect with us on social media (LinkedIn, Twitter, Facebook and Instagram).

Loading…

NEWS

Zip CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

March 27, 2026 10:34 AM

Hackers Use Phishing ZIP Files to Deploy PXA Stealer Against Financial Firms

PXA Stealer attacks rise, using phishing ZIP downloads to steal data, replacing Lumma and RedLine in global cybercrime campaigns.

Read Article

March 13, 2026 07:00 AM

Zombie ZIP vulnerability lets compressed malware leisurely stroll past 95% of antivirus apps — security suites are blissfully unaware of security issue

The ongoing arms race of cybersecurity and countermeasures has become incredibly advanced and complicated. More often than not,...

Read Article

March 10, 2026 05:11 PM

Malformed ZIP Files Allows Attackers to Bypass Antivirus and EDR Detections

A flaw in ZIP archive processing lets attackers hide malware in malformed headers, bypassing antivirus and EDR scanners.

Read Article

February 18, 2026 07:27 AM

Malicious Triton App Fork Emerges On GitHub, Posing Threat To Cybersecurity

A recent discovery on GitHub has raised alarms in the cybersecurity community, as a malicious fork of the legitimate macOS app Triton has.

Read Article

February 12, 2026 08:00 AM

Unofficial 7-zip.com website served up malware-laden downloads for over a week — infected PCs forced into a proxy botnet

When setting up a new PC, installing a utility like 7-zip, PeaZip, or WinRAR is something we tend to do almost without thinking.

Read Article

February 10, 2026 08:00 AM

Hackers Weaponizing 7-Zip Downloads to Turn Your Home Computers into Proxy Nodes

Fake 7-Zip installers from a lookalike site turn home PCs into residential proxy nodes while appearing fully legitimate.

Read Article

February 07, 2026 10:48 AM

Best 3 Cybersecurity Certifications for Mid-Level Professionals in 2026

Skills, knowledge, experience, and a solid grasp of cybersecurity concepts are non-negotiable for those aspiring to accelerate their cybersecurity careers...

Read Article

January 29, 2026 08:00 AM

WinRAR exploit reportedly remains widely-used by China and Russia state actors despite patch — vulnerability allows malicious archives to deliver a hidden payload to Windows Startup folder

A WinRAR exploit that has been discovered and patched in July 2025 remains widely used by threat actors — many of them government-backed...

Read Article

January 29, 2026 08:00 AM

AI-assisted cybersecurity team discovers 12 OpenSSL vulnerabilities, claims humans are the limiting factor — some vulnerabilities have been around for decades

OpenSSL is a security standard that protects most of the internet, and cybersecurity researchers have recently discovered vulnerabilities in...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-73250

SUMMARY

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.

Published

Date2026-08-11

Updated

Date2026-08-11

RISK INFORMATION (Score: )

cvss4

Base Score: 5.4

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-73249

SUMMARY

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

Published

Date2026-08-11

Updated

Date2026-08-11

RISK INFORMATION (Score: 7.5)

cvss3

Base Score: 7.5

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Impact Score

3.6

Exploitability

3.9

REFERENCES

CVE-2026-73248

SUMMARY

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.

Published

Date2026-08-11

Updated

Date2026-08-11

RISK INFORMATION (Score: )

cvss4

Base Score: 8.5

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-73247

SUMMARY

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.

Published

Date2026-08-11

Updated

Date2026-08-11

RISK INFORMATION (Score: 8.6)

cvss3

Base Score: 8.6

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Impact Score

Exploitability

3.9

REFERENCES

https://github.com/kestra-io/kestra/security/advisories/GHSA-r56g-q4p6-m3p6

CVE-2026-73246

SUMMARY

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.

Published

Date2026-08-11

Updated

Date2026-08-11

RISK INFORMATION (Score: 7.5)

cvss3

Base Score: 7.5

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Impact Score

3.6

Exploitability

3.9

REFERENCES

https://github.com/kestra-io/kestra/security/advisories/GHSA-m65f-q5gj-hg46

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…