RiskRecon

What RiskRecon does

RiskRecon, founded in 2015 and headquartered in Murray (Salt Lake City), Utah with a secondary office in Boston, is a third-party cyber risk management SaaS provider that delivers continuous, externally observable cybersecurity and privacy ratings on organizations' internet-facing systems. The platform non-intrusively collects externally observable security indicators across 196,000 organizations in 178 countries, producing certified cyber ratings (99.1% independently certified accuracy), privacy ratings, custom-tuned assessments, automated vendor remediation workflows, and systemic supply chain risk analytics. Core technology is passive external scanning and asset attribution, augmented post-Mastercard acquisition by integration with Recorded Future's threat intelligence, and extended through add-on modules including Cyber Quant (financial risk quantification), Systemic Risk Assessment (fourth-party visibility), My Cyber Risk (SMB-focused), and Onboard Risk Check (vendor onboarding diligence).

RiskRecon monetizes through annual enterprise SaaS subscriptions priced by vendor portfolio size and feature scope, sold both directly and via authorized resellers, with a freemium 30-day trial covering up to 50 vendor ratings to seed product-led adoption into mid-market accounts. The go-to-market combines direct enterprise sales, a channel partner program, and Mastercard's global distribution network, targeting large enterprises and regulated institutions in financial services, healthcare, manufacturing, energy, and biotech. Following the January 2025 $350 million acquisition by Mastercard, RiskRecon operates as a wholly-owned subsidiary branded 'RiskRecon by Mastercard,' governed under Delaware law as RiskRecon Inc., and integrated into Mastercard's cybersecurity portfolio alongside Recorded Future, Cloudflare partnership assets, and VikingCloud channel partnerships.

Name

RiskRecon

Legal name

RiskRecon Inc.

Website

https://riskrecon.com

Company type

Private

Founded year

2015

Operating status

Operating

Headcount range

101–250 employees

Short description

RiskRecon is a third-party cyber risk management SaaS platform that continuously monitors 196,000 organizations across 178 countries, delivering externally observable cybersecurity ratings, privacy assessments, and vendor remediation workflows. It serves large enterprises and regulated institutions in financial services, healthcare, manufacturing, and energy, and operates as a wholly-owned subsidiary of Mastercard following the 2025 acquisition.

Ownership category

akta.pro rank

Product category

Third-Party Cyber Risk Management

NAICS

Security Systems Services (except Locksmiths) (561621)

SIC

Services-Consumer Credit Reporting, Collection Agencies (7320)

akta.pro primary industry

Risk Scoring, Fraud & Anomaly Detection (HDAAAHAD)

akta.pro secondary industry

Payments Fraud & Chargeback Prevention (HDADALAE)

Keywords

• Third-party risk management
• Cybersecurity risk ratings
• Vendor cyber monitoring
• Supply chain cybersecurity
• Cyber risk quantification

Headquarters

HQ city

Salt Lake City

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations

Revenue model

1. Subscription SaaS Platform Access: Annual subscription model for access to the RiskRecon cybersecurity risk ratings platform. Subscriptions are sold directly through Mastercard or through authorized resellers. Annual billing with multi-year contract options available. Includes portal access, vendor ratings, and assessment tools.

Pricing tiers

Go-to-market motion1 record

Distribution channels3 records

Marketing channels7 records

Core offering

RiskRecon is a continuous external cybersecurity assessment platform that monitors and rates organizations' internet-facing systems and security posture. It provides third-party risk management through automated cyber ratings, privacy ratings, custom-tuned assessments, and supply chain risk visibility, enabling enterprises to evaluate and continuously monitor the cyber performance of their vendors and partners.

Product overview

RiskRecon, now part of Mastercard, offers a unified third-party risk management platform built around continuous cyber security monitoring. The core offering consists of RiskRecon Cyber Ratings (continuous vendor monitoring), RiskRecon Privacy Ratings (privacy assessment), and RiskRecon Assessments (customized evaluations), complemented by Threat Protection by Mastercard for threat intelligence. Additional modules include Cyber Quant for financial risk quantification, Systemic Risk Assessment for supply chain analysis, My Cyber Risk for SMBs, and Onboard Risk Check for vendor onboarding. The platform integrates the RiskRecon ratings capability with Mastercard's threat intelligence infrastructure following the acquisition.

Differentiator

Problem solved

Functional benefit

Brands

• RiskRecon Cyber Ratings: Automated cybersecurity risk ratings platform providing external assessments of organizations' security postures.
• RiskRecon Privacy Ratings
• RiskRecon Assessments
• Threat Protection by Mastercard
• Cyber Quant by Mastercard
• RiskRecon Academy

Products and services

• RiskRecon Cyber Ratings

Quantifiable outcome

• 33% increase in third-party risk visibility when using combined Recorded Future + RiskRecon platform
• +3 more outcomes

Named customers7 records

Segments4 records

Ideal customer profiles1 record

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature8 records

Partnerships

Four partnerships are on record, tiered core and strategic.

• Recorded FuturecoreTechnology or IntegrationRiskRecon ratings capability is integrated with Recorded Future's proprietary threat intelligence. The combined platform delivers approximately 33% increase in third-party risk visibility and saves 7 hours per week on manual research. RiskRecon was acquired by Mastercard which also owns Recorded Future.
• CloudflarestrategicStrategic or Co-development PartnerMastercard partnered with Cloudflare to develop cybersecurity tools aimed at protecting small businesses, critical infrastructure, and governments from cyber threats. The partnership includes attack surface monitoring, real-time cyber posture assessment, and risk mitigation capabilities.
• VikingCloudstrategicStrategic or Co-development PartnerMastercard announced partnership with VikingCloud as part of cybersecurity initiatives including the Mastercard Business Builder program and Trust Center solutions to help SMEs address cyber threats.
• American Hospital Association (AHA)strategicStrategic or Co-development PartnerMastercard Cybersecurity, including RiskRecon, was named an American Hospital Association preferred cybersecurity service provider for Third-Party and Supply Chain Monitoring, supporting the nation's hospitals with cybersecurity risk management.

Scale indicators6 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• SecurityScorecard: SecurityScorecard is a direct competitor in cybersecurity risk ratings, offering continuous external security ratings, vendor risk management, and third-party risk workflows targeting the same enterprise buyers as RiskRecon.
• BitSight: BitSight is a direct competitor in the cyber risk ratings market, providing continuous security performance monitoring and analytics for enterprises and third-party risk programs, overlapping closely with RiskRecon's core offering.
• UpGuard: UpGuard is a direct competitor offering external attack surface monitoring and vendor risk ratings, serving similar enterprise customers with comparable continuous cyber risk assessment capabilities.
• Panorays: Panorays is a direct competitor focused on third-party security risk management, combining external attack surface assessments with questionnaire automation — competing head-to-head with RiskRecon in the TPRM space.
• CyberGRX: CyberGRX is a TPRM-focused competitor offering vendor cyber risk assessments and a third-party risk exchange, serving overlapping enterprise customers looking to operationalize third-party risk programs.
• ProcessUnity: ProcessUnity provides third-party risk management workflows and automation, often paired with cyber ratings data — competing with RiskRecon's adjacent assessments and workflow modules in the same enterprise TPRM deals.
• Prevalent: Prevalent offers third-party risk management combining vendor assessments, threat intelligence, and continuous monitoring — overlapping with RiskRecon's TPRM and supply chain monitoring capabilities.
• Black Kite: Black Kite is a direct competitor in cyber risk ratings and third-party risk management, providing external attack surface assessments and ransomware susceptibility scoring that overlap with RiskRecon's continuous monitoring capabilities.

Broad incumbents

• OneTrust: OneTrust is a broad GRC, privacy, and TPRM platform that includes third-party risk workflows and integrations with cyber ratings providers — competing with RiskRecon as a wider governance suite rather than a specialist ratings vendor.

Others

• Recorded Future: Recorded Future, also owned by Mastercard, is integrated with RiskRecon to deliver combined threat intelligence and ratings — functioning as a sister capability rather than a competitor, but a key enabling partner for RiskRecon's differentiated offering.

Market position

Strengths5 records

Weaknesses4 records

Competitive moat5 records

Key risks5 records

Key highlights7 records

Customer concentration

• Xx.com/riskrecon
• Facebookfacebook.com/riskrecon
• LinkedInlinkedin.com/company/riskrecon

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds3 records

Investors5 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about RiskRecon