MetricStream vs RiskRecon

About RiskRecon

RiskRecon sells vendor security monitoring that is custom-tuned to match a customer's risk policy. RiskRecon is a Mastercard company. RiskRecon monitors third-party cyber risk, including the cyber risk of their vendors, based purely on their Internet presence. RiskRecon action plans are prioritized by asset value and issue severity.^[2][6][7]

Cyber risk can originate in supply chain layers beyond an organization's immediate third parties. RiskRecon reporting identifies fourth-party concentration risk. RiskRecon provides data on which vendors are exposed to critical vulnerabilities.^[6][8]

Every RiskRecon assessment is custom-fitted to match a customer's risk appetite. Value at risk is determined automatically for every system, based on the data types the system collects and the system functionality. RiskRecon customers can share RiskRecon action plans with vendors, giving them access to the security issues and tools needed to address the items that are important to the customer. RiskRecon automatically tracks and reports each vendor's progress in addressing their action plan issues. RiskRecon provides the IT environment details and an objective cybersecurity assessment before analysts engage a vendor. RiskRecon provides data-driven insights for prioritizing vendor risk assessments. RiskRecon provides objective assessments for each of the parties being evaluated in a new vendor selection process.^[6][8][15]

RiskRecon continuously monitors the cybersecurity of a customer's own enterprise. RiskRecon assesses the security risk of internet-facing systems across multiple security domains spanning 41 security criteria, covering areas such as software patching, web encryption and email security. An acquisition's asset inventory can be compared with systems discovered through RiskRecon's proprietary method.^[8]

RiskRecon allows organizations to measure privacy risk across the entire vendor ecosystem. Vendors are evaluated across six privacy domains and assigned a rating from A to F. Machine learning models compile data from various sources to create a privacy risk profile for third-party vendors. The privacy rating verifies the presence of a privacy policy and analyzes the details of the policy to ensure privacy rights are included. The privacy rating determines whether a consent management (opt-in/opt-out) system is present for customers to specify how and with whom their personal information will be shared. The privacy rating assesses whether data collected on websites is securely encrypted both during collection and while in transit. The privacy rating detects whether personal data is transmitted or stored in the E.U., U.K., U.N. or OFAC countries known to have comprehensive sanctions related to technology or telecommunications. The privacy rating identifies instances where personal data may have been compromised and checks whether authorities have flagged issues in a company's handling of personal information.^[10]

Cyber Quant translates technical cybersecurity data into financial and business metrics. Cyber Quant combines risk quantification, threat intelligence, control maturity insights and executive reporting in a unified workflow. Financial impact analysis and scenario simulations are used to compare remediation strategies and prioritize investments. Cyber Crisis Exercise combines Mastercard cybersecurity expertise, threat intelligence and realistic simulation technology to help organizations evaluate and strengthen their crisis response capabilities. Crisis scenarios are customized based on likely attack vectors, industry trends, threat intelligence and the organization's operating environment. A post-exercise assessment covers strengths, gaps, benchmark insights and recommendations. Threat Protection differentiates between good and bad bots. Global Threat Protection Centers are available 24/7/365, removing bad traffic at both network and application layers. Threat Intelligence lays the foundation for Threat Protection, and the threat data comes from a global sensor network. Approximately 5-10k honeypots are deployed globally to gather threat intelligence.^{[1][3][6][8][11][12][13][14]}