Bitsight, Black Kite, iCOUNTER and RiskRecon

About Black Kite

Black Kite sells an AI-native third-party cyber risk management platform. Black Kite continuously monitors millions of organizations worldwide, giving customers visibility across their entire vendor ecosystem, extending to nth parties. Black Kite helps organizations uncover risks that would otherwise remain hidden across their extended supply chain.^[1]

Black Kite describes third party risk management as a way to understand, govern, and act on risk introduced by vendors and suppliers. Black Kite says most third party risk programs were built around questionnaires, annual reviews, and blackbox scores that nobody can fully explain. Annual questionnaires and periodic reviews become outdated quickly and fail to reflect how risk changes between assessments. Risk, security, procurement, and compliance often operate in parallel rather than together. Black Kite helps organizations move beyond point-in-time scores and annual reviews toward ongoing risk visibility and collaborative remediation.^[6]

Black Kite gives always-on visibility into vendor risk, with intelligence on adversary targeting, ransomware susceptibility, active cyber events, and financial exposure. Black Kite's AI parses vendor documents, extracts relevant evidence, and maps controls across frameworks. Black Kite identifies vendors impacted by critical vulnerabilities, breaches, and other active exposures. Black Kite says autonomous monitoring and predictive intelligence reveal risks as they emerge, and that vendors can then be engaged through The Bridge to close the loop on risk remediation.^[1][7]

Black Kite Extend identifies fourth- and fifth-party relationships through automated supply chain mapping. Black Kite Extend covers Nth-party mapping, geopolitical monitoring, threat actor tracking, and product-level risk analysis in one package. Black Kite Extend gives teams the depth of visibility that modern SCRM requires.^[8][9]

Black Kite applies Open FAIR to vendor and supply chain risk scenarios, translating a vendor's cyber posture into dollar-denominated exposure. Black Kite's Cyber Risk Quantification translates technical cyber risk into financial terms. Black Kite automatically estimates probable financial impact across ransomware, data breach, and business interruption scenarios. Black Kite's Ransomware Susceptibility Index predicts the likelihood of a vendor being hit by ransomware before an attack occurs. When a major breach, ransomware attack, or active exploitation of a vulnerability occurs, Black Kite FocusTags are automatically applied to affected vendors in a customer's portfolio.^{[1][6][7][10][11][12]}

Black Kite delivers AI-powered vendor risk assessments that provide security insights in hours, not weeks. AI-powered document parsing analyzes vendor security policies, SOC 2 reports, and trust center artifacts in minutes, not weeks. The Black Kite Bridge replaces email sprawl with centralized vendor collaboration. Black Kite delivers continuous vendor risk monitoring that keeps pace with a customer's business and the complexity of its supply chain. Black Kite Intelligence tracks ransomware campaigns, credential leaks, active exploitation, and high-impact zero-days. For vendor risk response, Black Kite delivers cyber risk intelligence and collaboration tools that turn vendor risk findings into resolved issues. Black Kite simplifies vendor compliance management with continuous cyber risk monitoring, automated framework assessments, and centralized reporting that demonstrates ongoing oversight to regulators and auditors. Black Kite integrates with existing GRC platforms, including ServiceNow and LogicGate.^{[8][13][14][15]}

Black Kite maps the cyber risk posture of entire supplier ecosystems, including the Nth-party relationships many organizations lack visibility into. According to Black Kite's research, every supplier breach now claims an average of 5.28 downstream victim organizations. Black Kite says AI has been foundational to its platform since day one, transforming billions of external risk signals into actionable intelligence. Black Kite's AI analyzes data from thousands of sources, including OSINT, dark web and hacker forums, and vulnerability data. Black Kite lets customers connect their own AI agents and orchestration toolchains to its platform and data. Black Kite has an open API and native integrations. Black Kite's open-standards methodology produces findings that are traceable and documented, supporting the requirements of DORA, SEC cyber disclosure rules, and the audit frameworks enterprise risk programs operate under.^[6][7][9]

Black Kite names GRC managers, CISOs, third-party risk teams and security operations teams as groups its approach serves. Black Kite says its platform is relied on across finance, healthcare, retail, government, and manufacturing. Organizations across financial services, healthcare, and technology rely on Black Kite's continuous monitoring. BK Labs is Black Kite's research and innovation organization. BK Labs analyzes ransomware, threat actors, and supply chain risk across more than 40 million organizations. BK Labs is led by Candan Bolukbas, Black Kite CTO and co-founder, and Dr Ferhat Dikbiyik, Chief Research and Intelligence Officer.^{[6][7][8][9][12][16]}

About iCOUNTER

In real time, iCOUNTER detects the active threats targeting a customer's vendors, suppliers, MSPs, SaaS providers, partners, and broader digital ecosystem.

An acceptable security posture can coexist with stolen credentials, access for sale, or an active compromise. Enterprise systems now depend on vendors, SaaS providers, and other third parties that third party risk management programs cannot continuously monitor.

CTOS (Counter Threat Operating System) is a cybersecurity platform that connects intelligence collection, risk determination, enterprise context, and counter-threat operations in one architecture. CTOS identifies active threats across a customer's extended ecosystem, determines their relevance to the business, and drives remediation with the affected third party. CTOS identifies adversary targeting, exposed credentials, campaign staging, and active compromise signals. Example threats include network or administrator access for sale, compromised VPN credentials, web shells, and data appearing in ransomware files. Active targeting and compromise signals are identified across critical third parties, technology providers, supply-chain partners, and subsidiaries. The Counter Threat Operating System (CTOS) includes third-party risk management and counter fraud capabilities.^{[1][5][9][10]}

CTOS combines global intelligence collection with a digital twin of the customer's ecosystem to determine which live threats matter to that customer. Intelligence collection across thousands of global sources, including cybercrime forums, credential markets, and ransomware sites, is owned and operated by iCOUNTER. Signals are collected continuously from adversary infrastructure, active compromise activity, exposed credentials, dark web sources, and third-party ecosystem telemetry. HUMINT is augmented with AI parsing of hundreds of databases to identify specific targeted threats. CTOS correlates threat signals against a digital twin of the customer's ecosystem to help determine whether a threat is real, which third parties are affected, the potential business impact, and who needs to act. CTOS determines risk at the Edge of Intelligence Collection, validating threat signals against the customer's ecosystem before findings reach the customer's team. CTOS connects third-party relationships and business dependencies to the organization's risk framework and tiers. AI helps CTOS correlate large volumes of threat signals and determine which are relevant to the customer's ecosystem. CTOS connects validated risk to existing security and risk workflows, and feedback from remediation outcomes informs the intelligence operation.^[6]

Using observable connection data, iCOUNTER maps a customer's ecosystem of vendors and data flows. Early warning is given if access to a vendor's network has been gained by cybercriminals. Vendors that have been victims of successful ransomware attacks, or that have exposed data that may include the customer's, are identified.^[6]

On the customer's behalf, iCOUNTER runs the intelligence-to-remediation operation: collecting and validating signals, determining ecosystem risk, engaging affected third parties, and coordinating remediation through completion. Under its terms, iCOUNTER provides managed third-party threat detection and response services that perform continuous reconnaissance across the customer's extended third-party ecosystem using human intelligence, technical intelligence, and adversary infrastructure monitoring. The managed services include a Validated Connectivity Inventory, which enumerates third parties based on verified bi-directional data exchange. Prescriptive Remediation provides actionable countermeasures with defensible evidence for third parties to take corrective actions. Analysts at iCOUNTER manage the CTOS Platform to track risk events, communicate with impacted third parties, and track third-party mitigations. Customers get access to the CTOS Platform for monitoring risk events, communications, and mitigations. Quarterly Business Reviews summarize alerts, mitigations, and current risk profile. Remediation is handled by iCOUNTER, which engages the affected third party, coordinates remediation, and tracks the fix to completion with evidence. Built-in metrics and remediation tracking are used to communicate progress to stakeholders and the board. The Managed Services and the CTOS Platform dashboard are provided by iCOUNTER, Inc.^[5]

CTOS complements a customer's existing program, including security ratings, questionnaires, GRC, threat intelligence, and SOC tools. Alongside a SecurityScorecard program, iCOUNTER adds its own intelligence collection, business-specific risk determination, and managed third-party response. A direct integration with SecurityScorecard is not required to begin an iCOUNTER engagement. Any data exchange or workflow integration can be scoped separately around the customer's environment and the products the customer uses. To start, a customer supplies a CSV of priority third parties and ecosystem partners. Customers share their risk framework, priorities, and current service coverage so the engagement can focus on relevant business dependencies. CTOS is aimed at CISOs, third-party risk managers, security operations teams, and compliance officers in enterprises and public sector organizations with complex third party ecosystems.^[8]

John Watters acquired iDEFENSE in 2002, four years after its founding in 1998, and later founded iSIGHT Partners in 2007. Following the merger of iSIGHT and Mandiant under the Mandiant brand, John Watters served as President and COO until the company's acquisition by Google in 2022.^{[5][6][8][9][10][11]}

About RiskRecon

RiskRecon sells vendor security monitoring that is custom-tuned to match a customer's risk policy. RiskRecon is a Mastercard company. RiskRecon monitors third-party cyber risk, including the cyber risk of their vendors, based purely on their Internet presence. RiskRecon action plans are prioritized by asset value and issue severity.^[2][6][7]

Cyber risk can originate in supply chain layers beyond an organization's immediate third parties. RiskRecon reporting identifies fourth-party concentration risk. RiskRecon provides data on which vendors are exposed to critical vulnerabilities.^[6][8]

Every RiskRecon assessment is custom-fitted to match a customer's risk appetite. Value at risk is determined automatically for every system, based on the data types the system collects and the system functionality. RiskRecon customers can share RiskRecon action plans with vendors, giving them access to the security issues and tools needed to address the items that are important to the customer. RiskRecon automatically tracks and reports each vendor's progress in addressing their action plan issues. RiskRecon provides the IT environment details and an objective cybersecurity assessment before analysts engage a vendor. RiskRecon provides data-driven insights for prioritizing vendor risk assessments. RiskRecon provides objective assessments for each of the parties being evaluated in a new vendor selection process.^[6][8][15]

RiskRecon continuously monitors the cybersecurity of a customer's own enterprise. RiskRecon assesses the security risk of internet-facing systems across multiple security domains spanning 41 security criteria, covering areas such as software patching, web encryption and email security. An acquisition's asset inventory can be compared with systems discovered through RiskRecon's proprietary method.^[8]

RiskRecon allows organizations to measure privacy risk across the entire vendor ecosystem. Vendors are evaluated across six privacy domains and assigned a rating from A to F. Machine learning models compile data from various sources to create a privacy risk profile for third-party vendors. The privacy rating verifies the presence of a privacy policy and analyzes the details of the policy to ensure privacy rights are included. The privacy rating determines whether a consent management (opt-in/opt-out) system is present for customers to specify how and with whom their personal information will be shared. The privacy rating assesses whether data collected on websites is securely encrypted both during collection and while in transit. The privacy rating detects whether personal data is transmitted or stored in the E.U., U.K., U.N. or OFAC countries known to have comprehensive sanctions related to technology or telecommunications. The privacy rating identifies instances where personal data may have been compromised and checks whether authorities have flagged issues in a company's handling of personal information.^[10]

Cyber Quant translates technical cybersecurity data into financial and business metrics. Cyber Quant combines risk quantification, threat intelligence, control maturity insights and executive reporting in a unified workflow. Financial impact analysis and scenario simulations are used to compare remediation strategies and prioritize investments. Cyber Crisis Exercise combines Mastercard cybersecurity expertise, threat intelligence and realistic simulation technology to help organizations evaluate and strengthen their crisis response capabilities. Crisis scenarios are customized based on likely attack vectors, industry trends, threat intelligence and the organization's operating environment. A post-exercise assessment covers strengths, gaps, benchmark insights and recommendations. Threat Protection differentiates between good and bad bots. Global Threat Protection Centers are available 24/7/365, removing bad traffic at both network and application layers. Threat Intelligence lays the foundation for Threat Protection, and the threat data comes from a global sensor network. Approximately 5-10k honeypots are deployed globally to gather threat intelligence.^{[1][3][6][8][11][12][13][14]}