RiskRecon
RiskRecon is a third-party cyber risk management SaaS platform that continuously monitors 196,000 organizations across 178 countries, delivering externally observable cybersecurity ratings, privacy assessments, and vendor remediation workflows. It serves large enterprises and regulated institutions in financial services, healthcare, manufacturing, and energy, and operates as a wholly-owned subsidiary of Mastercard following the 2025 acquisition.
- Company typePrivate
- Founded2015
- HeadquartersSalt Lake City, United States
- Headcount101–250
- GTM typeB2B
- OfferingSoftware
What RiskRecon does
RiskRecon, founded in 2015 and headquartered in Murray (Salt Lake City), Utah with a secondary office in Boston, is a third-party cyber risk management SaaS provider that delivers continuous, externally observable cybersecurity and privacy ratings on organizations' internet-facing systems. The platform non-intrusively collects externally observable security indicators across 196,000 organizations in 178 countries, producing certified cyber ratings (99.1% independently certified accuracy), privacy ratings, custom-tuned assessments, automated vendor remediation workflows, and systemic supply chain risk analytics. Core technology is passive external scanning and asset attribution, augmented post-Mastercard acquisition by integration with Recorded Future's threat intelligence, and extended through add-on modules including Cyber Quant (financial risk quantification), Systemic Risk Assessment (fourth-party visibility), My Cyber Risk (SMB-focused), and Onboard Risk Check (vendor onboarding diligence).
RiskRecon monetizes through annual enterprise SaaS subscriptions priced by vendor portfolio size and feature scope, sold both directly and via authorized resellers, with a freemium 30-day trial covering up to 50 vendor ratings to seed product-led adoption into mid-market accounts. The go-to-market combines direct enterprise sales, a channel partner program, and Mastercard's global distribution network, targeting large enterprises and regulated institutions in financial services, healthcare, manufacturing, energy, and biotech. Following the January 2025 $350 million acquisition by Mastercard, RiskRecon operates as a wholly-owned subsidiary branded 'RiskRecon by Mastercard,' governed under Delaware law as RiskRecon Inc., and integrated into Mastercard's cybersecurity portfolio alongside Recorded Future, Cloudflare partnership assets, and VikingCloud channel partnerships.
RiskRecon firmographics
Firmographics- Name
- RiskRecon
- Legal name
- RiskRecon Inc.
- Website
- https://riskrecon.com
- Company type
- Private
- Founded year
- 2015
- Operating status
- Operating
- Headcount range
- 101–250 employees
- Short description
- RiskRecon is a third-party cyber risk management SaaS platform that continuously monitors 196,000 organizations across 178 countries, delivering externally observable cybersecurity ratings, privacy assessments, and vendor remediation workflows. It serves large enterprises and regulated institutions in financial services, healthcare, manufacturing, and energy, and operates as a wholly-owned subsidiary of Mastercard following the 2025 acquisition.
- Ownership category
- akta.pro rank
RiskRecon industry classification
Industry- Product category
- Third-Party Cyber Risk Management
- NAICS
- Security Systems Services (except Locksmiths) (561621)
- SIC
- Services-Consumer Credit Reporting, Collection Agencies (7320)
- akta.pro primary industry
- Risk Scoring, Fraud & Anomaly Detection (HDAAAHAD)
- akta.pro secondary industry
- Payments Fraud & Chargeback Prevention (HDADALAE)
Keywords
Where RiskRecon is headquartered
LocationHeadquarters
- HQ city
- Salt Lake City
- HQ country
- United States
- HQ region
- North America
Offices2 records
Markets served
RiskRecon business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations
Revenue model
- Subscription SaaS Platform Access: Annual subscription model for access to the RiskRecon cybersecurity risk ratings platform. Subscriptions are sold directly through Mastercard or through authorized resellers. Annual billing with multi-year contract options available. Includes portal access, vendor ratings, and assessment tools.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Monthly | Free Trial - 30-day evaluation of up to 50 vendor ratings |
| Subscription | Annual | Enterprise Subscription - Full platform access with custom scope |
Go-to-market motion1 record
Distribution channels3 records
Marketing channels7 records
RiskRecon product offering
Product offeringCore offering
RiskRecon is a continuous external cybersecurity assessment platform that monitors and rates organizations' internet-facing systems and security posture. It provides third-party risk management through automated cyber ratings, privacy ratings, custom-tuned assessments, and supply chain risk visibility, enabling enterprises to evaluate and continuously monitor the cyber performance of their vendors and partners.
Product overview
RiskRecon, now part of Mastercard, offers a unified third-party risk management platform built around continuous cyber security monitoring. The core offering consists of RiskRecon Cyber Ratings (continuous vendor monitoring), RiskRecon Privacy Ratings (privacy assessment), and RiskRecon Assessments (customized evaluations), complemented by Threat Protection by Mastercard for threat intelligence. Additional modules include Cyber Quant for financial risk quantification, Systemic Risk Assessment for supply chain analysis, My Cyber Risk for SMBs, and Onboard Risk Check for vendor onboarding. The platform integrates the RiskRecon ratings capability with Mastercard's threat intelligence infrastructure following the acquisition.
Differentiator
Problem solved
Functional benefit
Brands
- RiskRecon Cyber Ratings: Automated cybersecurity risk ratings platform providing external assessments of organizations' security postures.
- RiskRecon Privacy Ratings
- RiskRecon Assessments
- Threat Protection by Mastercard
- Cyber Quant by Mastercard
- RiskRecon Academy
Products and services
- RiskRecon Cyber Ratings
Quantifiable outcome
- 33% increase in third-party risk visibility when using combined Recorded Future + RiskRecon platform
- +3 more outcomes
Companies that use RiskRecon
Customer profileNamed customers7 records
Segments4 records
Ideal customer profiles1 record
RiskRecon technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Feature8 records
RiskRecon partnerships and signals
Strategic signalPartnerships
Four partnerships are on record, tiered core and strategic.
- Recorded FuturecoreRiskRecon ratings capability is integrated with Recorded Future's proprietary threat intelligence. The combined platform delivers approximately 33% increase in third-party risk visibility and saves 7 hours per week on manual research. RiskRecon was acquired by Mastercard which also owns Recorded Future.
- CloudflarestrategicMastercard partnered with Cloudflare to develop cybersecurity tools aimed at protecting small businesses, critical infrastructure, and governments from cyber threats. The partnership includes attack surface monitoring, real-time cyber posture assessment, and risk mitigation capabilities.
- VikingCloudstrategicMastercard announced partnership with VikingCloud as part of cybersecurity initiatives including the Mastercard Business Builder program and Trust Center solutions to help SMEs address cyber threats.
- American Hospital Association (AHA)strategicMastercard Cybersecurity, including RiskRecon, was named an American Hospital Association preferred cybersecurity service provider for Third-Party and Supply Chain Monitoring, supporting the nation's hospitals with cybersecurity risk management.
Scale indicators6 records
Recent moves6 records
Expansion highlights5 records
RiskRecon competitors and assessment
Company assessmentDirect peers
- SecurityScorecard: SecurityScorecard is a direct competitor in cybersecurity risk ratings, offering continuous external security ratings, vendor risk management, and third-party risk workflows targeting the same enterprise buyers as RiskRecon.
- BitSight: BitSight is a direct competitor in the cyber risk ratings market, providing continuous security performance monitoring and analytics for enterprises and third-party risk programs, overlapping closely with RiskRecon's core offering.
- UpGuard: UpGuard is a direct competitor offering external attack surface monitoring and vendor risk ratings, serving similar enterprise customers with comparable continuous cyber risk assessment capabilities.
- Panorays: Panorays is a direct competitor focused on third-party security risk management, combining external attack surface assessments with questionnaire automation — competing head-to-head with RiskRecon in the TPRM space.
- CyberGRX: CyberGRX is a TPRM-focused competitor offering vendor cyber risk assessments and a third-party risk exchange, serving overlapping enterprise customers looking to operationalize third-party risk programs.
- ProcessUnity: ProcessUnity provides third-party risk management workflows and automation, often paired with cyber ratings data — competing with RiskRecon's adjacent assessments and workflow modules in the same enterprise TPRM deals.
- Prevalent: Prevalent offers third-party risk management combining vendor assessments, threat intelligence, and continuous monitoring — overlapping with RiskRecon's TPRM and supply chain monitoring capabilities.
- Black Kite: Black Kite is a direct competitor in cyber risk ratings and third-party risk management, providing external attack surface assessments and ransomware susceptibility scoring that overlap with RiskRecon's continuous monitoring capabilities.
Broad incumbents
- OneTrust: OneTrust is a broad GRC, privacy, and TPRM platform that includes third-party risk workflows and integrations with cyber ratings providers — competing with RiskRecon as a wider governance suite rather than a specialist ratings vendor.
Others
- Recorded Future: Recorded Future, also owned by Mastercard, is integrated with RiskRecon to deliver combined threat intelligence and ratings — functioning as a sister capability rather than a competitor, but a key enabling partner for RiskRecon's differentiated offering.
Market position
Strengths5 records
Weaknesses4 records
Competitive moat5 records
Key risks5 records
Key highlights7 records
Customer concentration
RiskRecon social profiles
Digital presenceRiskRecon compliance and trust
Trust signalCompliance2 records
RiskRecon financial estimates
Financial estimateRevenue estimate
Valuation estimate
RiskRecon leadership team
Management profileNumber of profiles
Profiles4 records
RiskRecon funding detail
Funding detailFunding overview
Funding rounds3 records
Investors5 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
RiskRecon M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about RiskRecon
What does RiskRecon do?
RiskRecon is a continuous external cybersecurity assessment platform that monitors and rates organizations' internet-facing systems and security posture. It provides third-party risk management through automated cyber ratings, privacy ratings, custom-tuned assessments, and supply chain risk visibility, enabling enterprises to evaluate and continuously monitor the cyber performance of their vendors and partners.
Is RiskRecon a public or private company?
RiskRecon is a private company. It is classified as corporate owned and is currently operating.
When was RiskRecon founded?
RiskRecon was founded in 2015. It employs 101 to 250 people.
Where is RiskRecon based?
RiskRecon is headquartered in Salt Lake City, United States, in the North America region.
How does RiskRecon make money?
One revenue line is on record: subscription SaaS Platform Access.
Who are RiskRecon's main competitors?
Direct peers on record are SecurityScorecard, BitSight, UpGuard, Panorays, CyberGRX, ProcessUnity, Prevalent and Black Kite. OneTrust is listed as a broad incumbent. Recorded Future is listed as an others.
Does RiskRecon have an API?
No public API is recorded for RiskRecon.
What industry is RiskRecon in?
RiskRecon's product category is Third-Party Cyber Risk Management. Its primary akta.pro industry code is HDAAAHAD, Risk Scoring, Fraud & Anomaly Detection, with a secondary code of HDADALAE, Payments Fraud & Chargeback Prevention. Its NAICS code is 561621 and its SIC code is 7320.