RiskRecon

What the company sells

RiskRecon sells vendor security monitoring that is custom-tuned to match a customer's risk policy. RiskRecon is a Mastercard company. RiskRecon monitors third-party cyber risk, including the cyber risk of their vendors, based purely on their Internet presence. RiskRecon action plans are prioritized by asset value and issue severity.

Cyber risk can originate in supply chain layers beyond an organization's immediate third parties. RiskRecon reporting identifies fourth-party concentration risk. RiskRecon provides data on which vendors are exposed to critical vulnerabilities.

Every RiskRecon assessment is custom-fitted to match a customer's risk appetite. Value at risk is determined automatically for every system, based on the data types the system collects and the system functionality. RiskRecon customers can share RiskRecon action plans with vendors, giving them access to the security issues and tools needed to address the items that are important to the customer. RiskRecon automatically tracks and reports each vendor's progress in addressing their action plan issues. RiskRecon provides the IT environment details and an objective cybersecurity assessment before analysts engage a vendor. RiskRecon provides data-driven insights for prioritizing vendor risk assessments. RiskRecon provides objective assessments for each of the parties being evaluated in a new vendor selection process.

RiskRecon continuously monitors the cybersecurity of a customer's own enterprise. RiskRecon assesses the security risk of internet-facing systems across multiple security domains spanning 41 security criteria, covering areas such as software patching, web encryption and email security. An acquisition's asset inventory can be compared with systems discovered through RiskRecon's proprietary method.

RiskRecon allows organizations to measure privacy risk across the entire vendor ecosystem. Vendors are evaluated across six privacy domains and assigned a rating from A to F. Machine learning models compile data from various sources to create a privacy risk profile for third-party vendors. The privacy rating verifies the presence of a privacy policy and analyzes the details of the policy to ensure privacy rights are included. The privacy rating determines whether a consent management (opt-in/opt-out) system is present for customers to specify how and with whom their personal information will be shared. The privacy rating assesses whether data collected on websites is securely encrypted both during collection and while in transit. The privacy rating detects whether personal data is transmitted or stored in the E.U., U.K., U.N. or OFAC countries known to have comprehensive sanctions related to technology or telecommunications. The privacy rating identifies instances where personal data may have been compromised and checks whether authorities have flagged issues in a company's handling of personal information.

Cyber Quant translates technical cybersecurity data into financial and business metrics. Cyber Quant combines risk quantification, threat intelligence, control maturity insights and executive reporting in a unified workflow. Financial impact analysis and scenario simulations are used to compare remediation strategies and prioritize investments. Cyber Crisis Exercise combines Mastercard cybersecurity expertise, threat intelligence and realistic simulation technology to help organizations evaluate and strengthen their crisis response capabilities. Crisis scenarios are customized based on likely attack vectors, industry trends, threat intelligence and the organization's operating environment. A post-exercise assessment covers strengths, gaps, benchmark insights and recommendations. Threat Protection differentiates between good and bad bots. Global Threat Protection Centers are available 24/7/365, removing bad traffic at both network and application layers. Threat Intelligence lays the foundation for Threat Protection, and the threat data comes from a global sensor network. Approximately 5-10k honeypots are deployed globally to gather threat intelligence.^{[1][2][3][6][7][8][10][11][12][13][14][15]}

Categories

• Third-party risk and security ratings (primary category)
• Compare RiskRecon with companies in the same categoryside by side

Headquarters

Salt Lake City, United States^[4]

Founded

Not established from our sources

Ownership

Owned by Mastercard^[5][9]

CISO on record

Not yet on our record. Send a verified source

Website

riskrecon.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

• RiskRecon^{[2][3][5][6][7][8][9][10][15]}

  Vendor security monitoring that is custom-tuned to match a customer's risk policy.

  RiskRecon customers can share RiskRecon action plans with vendors, giving them access to the security issues and tools needed to address the items that are important to the customer. RiskRecon automatically tracks and reports each vendor's progress in addressing their action plan issues.

• RiskRecon Privacy Risk Rating^[10]

  RiskRecon Privacy Risk Rating gives insights into a vendor's privacy practices.

  Vendors are evaluated across six privacy domains and assigned a rating from A to F. Machine learning models compile data from various sources to create a privacy risk profile for third-party vendors.

• Cyber Quant^[5][11]

  Cyber Quant translates technical cybersecurity data into financial and business metrics.

  Cyber Quant combines risk quantification, threat intelligence, control maturity insights and executive reporting in a unified workflow. Financial impact analysis and scenario simulations are used to compare remediation strategies and prioritize investments.

• Cyber Crisis Exercise^[12]

  Cyber Crisis Exercise combines Mastercard cybersecurity expertise, threat intelligence and realistic simulation technology to help organizations evaluate and strengthen their crisis response capabilities.

  Crisis scenarios are customized based on likely attack vectors, industry trends, threat intelligence and the organization's operating environment. A post-exercise assessment covers strengths, gaps, benchmark insights and recommendations.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of RiskRecon's categories, then alphabetical. A list from the record, never a ranking.

• On third-party risk and security ratings, RiskRecon competes with Bitsight, Black Kite, iCOUNTER, Panorays, Prevalent, SecurityScorecard, UpGuard, Whistic, Anecdotes, Apptega and 28 more.

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

1. [1]RiskRecon by MastercardRiskRecon, a Mastercard Company · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
2. [2]Video understand and act on third party risk with riskreconRiskRecon, a Mastercard Company · riskrecon.com · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
3. [3]DefaultMastercard · investor.mastercard.com · published December 23, 2019 · Tier A: the company, a regulator or a filing
4. [4]Riskrecon third party cyber risk management provider secures 25 million in series b funding led by accelRiskRecon · blog.riskrecon.com · published August 7, 2018 · Tier A: the company, a regulator or a filing
5. [5]Manage Cyber Security Risks | Risk Management —RiskRecon by MastercardRiskRecon · undated page, accessed October 28, 2026 · Tier A: the company, a regulator or a filing
6. [6]Third-Party Risk Management | RiskReconRiskRecon · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
7. [7]Thank you for your form submission | RiskReconRiskRecon · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
8. [8]Finance | RiskReconRiskRecon · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
9. [9]Mergers and Acquisitions | RiskReconRiskRecon · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
10. [10]RiskRecon PrivacyRiskRecon · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
11. [11]Mastercard Cyber QuantRiskRecon · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
12. [12]Mastercard Cyber Crisis ExerciseRiskRecon · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
13. [13]Comprehensive Threat Protection for BusinessesRiskRecon · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
14. [14]Solutions | Insurance Providers | RiskReconRiskRecon · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
15. [15]Energy Companies | RiskReconRiskRecon · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing

Last verified November 2, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded September 27, 2026, expanded November 10, 2026 from the references above.

Work for RiskRecon? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.