RiskRecon

RiskRecon, founded in 2015 in Salt Lake City and acquired by Mastercard in a $150 million deal that closed in January 2020, provides continuous, outside-in cyber risk ratings for third-party and supply-chain risk management. The platform scans publicly observable data about an organization’s internet-facing systems and translates it into asset-level risk scores that map to dollar-value business impact, letting security and procurement teams prioritize vendor remediation without requiring the vendor to fill out a questionnaire.

Since the Mastercard acquisition, RiskRecon has been folded into Mastercard’s broader Cyber Secure and Cyber Resilience program offerings, giving it distribution through Mastercard’s banking and enterprise relationships that a standalone startup would not have had. The trade-off of that integration is that RiskRecon now competes and evolves within a larger risk-rating category (alongside BitSight, SecurityScorecard and UpGuard) that has matured and become more commoditized since RiskRecon’s early days as a fast-growing independent vendor.

For CISOs and third-party risk teams, especially in financial services where Mastercard’s relationships run deep, RiskRecon offers a well-established, continuously updated external risk-rating feed with a specific claim of independently verified 99.1% rating accuracy. Buyers should treat that accuracy figure, and other efficacy claims, as vendor-reported until validated against their own environment, and should weigh RiskRecon’s now-conservative pace of innovation as part of a large acquirer against more nimble independent risk-rating challengers.