RiskRecon
RiskRecon is a cybersecurity ratings platform for organizations assessing exposure across their vendor ecosystems.
What RiskRecon is
RiskRecon is a cybersecurity ratings platform for organizations assessing exposure across their vendor ecosystems. It continuously monitors third parties and provides visibility into cyber risks, while asset discovery uses analyst-assisted machine-learning models to attribute assets as they change. Findings are ranked by issue severity and estimated asset value, with estimates based on factors such as authentication, transaction capabilities, and collected data types. Teams can create risk-prioritized vendor action plans, and vendors can track remediation in a portal at no cost and without time restrictions. Its Whistic-powered assessment tools use AI to help answer questionnaires, summarize documentation, and check compliance across a vendor catalog. APIs support integration of cybersecurity and supply-chain risk data into partner services. Ratings cover externally visible systems, not direct inspection of internal systems. RiskRecon is available through web and API platforms, with continuous score refresh, change alerts, and full attack-surface coverage. Pricing is on request; a 30-day trial is available, including a quick-start guide and access to Solutions Consulting. The free 30-day portal access plan covers ratings for up to 50 vendors and a report on your organization.
Good
- Continuously monitors vendors across an organization’s ecosystem.
- Prioritizes findings using severity and estimated asset value.
- Vendor portal supports remediation tracking at no cost.
- Continuous score refresh and change alerts are available.
- 30-day trial includes a quick-start guide and consulting access.
Watch out
- Ratings cover externally visible systems, not internal inspection.
- Subscriptions require a sales quote.
- No general free plan is available.
Who it suits
RiskRecon is aimed at third-party risk teams, internal security analysts, M&A teams, CISOs, and boards. It suits organizations that need to monitor vendor cyber risk and prioritize remediation.
Verdict
RiskRecon combines ongoing vendor monitoring with tools for prioritizing findings and tracking remediation. Its ratings describe external posture, so they do not directly assess internal systems.
Plans and prices
From RiskRecon's own pricing page, checked 15 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| 30-day free trial | Free | security ratings for up to 50 vendors · own-organization report · prioritized findings · onboarding guide · Solutions Consulting access |
| Free 30-day portal access | Free | 30 days · security ratings for up to 50 vendors · report on your organization · risk-prioritized findings |
| Paid subscription | Priced on request | pricing varies by vendors monitored, assessment depth and selected features |
| RiskRecon subscriptions | Priced on request | Pricing provided in an enrollment form or subscription documentation; contact sales for a quote |
The facts
Each one read from RiskRecon's own pages, with the date it was checked.
What it does
- Accuracy
- RiskRecon says its asset attribution is independently certified to 99.1% accuracy.checked 30 Sep 2026
- AI assessments
- RiskRecon Assessments uses retrieval-augmented generation to create vendor and SOC 2 summaries and automate questionnaire responses.checked 15 Oct 2026
- Alliance extensibility
- RiskRecon offers APIs, data feeds and OEM or white-label embedding for technology and managed-service partners.checked 15 Oct 2026
- API authentication
- The API documentation specifies Bearer JWT authentication and sandbox base URLs.checked 15 Oct 2026
- API ecosystem
- Axonius documents a RiskRecon adapter that uses an API key to fetch assets, findings and action-plan findings.checked 15 Oct 2026
- API reports
- The API can request executive, summary, detailed and action-plan PDF reports for a target of evaluation.checked 15 Oct 2026
- Assessment scope
- RiskRecon assesses externally visible systems, so its ratings reflect an organization’s external posture rather than a direct inspection of internal systems.checked 30 Sep 2026
- Asset attribution
- RiskRecon says its asset attribution is independently certified at 99.1% accuracy with a false-positive rate below 1%.checked 15 Oct 2026
- Asset discovery
- Its asset discovery uses analyst-assisted machine-learning models tailored to each monitored company to attribute assets as they change over time.checked 30 Sep 2026
- Benchmarking
- The platform supports comparing vendor risk performance and benchmarking against peers or industry standards.checked 15 Oct 2026
- Continuous monitoring
- The platform continuously assesses vendors instead of relying only on point-in-time questionnaires.checked 15 Oct 2026
- Custom risk policy
- Customers can tune security criteria and monitoring to their own risk appetite and policy requirements.checked 15 Oct 2026
- Documentation depth
- Public API documentation includes parameters, enums, response codes, authentication details and example requests.checked 15 Oct 2026
- Fourth-party visibility
- RiskRecon can discover and visualize fourth-party entities without requiring additional approvals or permissions.checked 15 Oct 2026
- Hosted delivery
- RiskRecon’s terms describe subscriber access to hosted services rather than a downloadable self-hosted product.checked 15 Oct 2026
- Integrations
- RiskRecon lists integrations with RSA Archer, Sigma Ratings, Whistic, ServiceNow and other GRC or workflow platforms.checked 15 Oct 2026
- Intended users
- The maker describes use by third-party risk teams, internal security analysts, M&A teams, CISOs, and boards.checked 30 Sep 2026
- Limit: G2 relevance
- A G2 reviewer reported that some findings or IP addresses were outside the organization’s scope or attributed to another company.checked 15 Oct 2026
- Limit: Gartner false positives
- Gartner’s displayed dislikes include false-positive concerns, incomplete customization and lack of combined offline assessment.checked 15 Oct 2026
Money
- Action plans
- The service automatically creates shareable vendor action plans containing issues that violate the customer’s policy.checked 15 Oct 2026
The company
- Company facts
- LinkedIn lists RiskRecon by Mastercard as privately held, founded in 2013, headquartered in Salt Lake City and employing 51–200 people.checked 15 Oct 2026
- Company history
- RiskRecon says it was founded by Kelly White and officially incorporated in October 2015.checked 30 Sep 2026
- Company ownership
- Mastercard announced an agreement to acquire RiskRecon in December 2019, with closing expected in the first quarter of 2020.checked 15 Oct 2026
- Headquarters
- RiskRecon says it is headquartered in Salt Lake City, Utah, with a presence in Boston, Massachusetts.checked 30 Sep 2026
Alternatives to RiskRecon
- 1
RiskWatch Vendor Risk Management
AndroidiOSWebAPI6.6 - 2
SAP CPQ
Web6.4From $24 a month - 3
Origami Risk Claims
AndroidiOSWebAPI6.3 - 4
Riskonnect
AndroidiOSWebAPI6.3 - 5
Protecht
WebAPI6.2 - 6
CYMETRIS
WebAPISelf-hosted6.0From €99 a month