- Home
- Risk Assessment Software
- RiskRecon
RiskRecon
RiskRecon says it is headquartered in Salt Lake City, Utah, with a presence in Boston, Massachusetts.
What it is
RiskRecon provides cybersecurity ratings and insights to help organizations understand and act on cyber risk. It continuously monitors vendors across an organization’s ecosystem and offers real-time visibility into third-party risks. Asset discovery uses analyst-assisted machine-learning models tailored to each monitored company to attribute assets as they change. Findings are prioritized by issue severity and estimated asset value, with estimates drawing on factors such as authentication, transaction capabilities, and collected data types. The platform can create prioritized action plans for vendors, who can track remediation in its portal at no cost and without time limits. RiskRecon Assessments Powered by Whistic uses AI to help answer questionnaires, summarize documentation, and check compliance across a vendor catalog. APIs support integration of cybersecurity and supply-chain risk data with partner platforms, applications, and services. Ratings assess externally visible systems, rather than directly inspecting internal systems. RiskRecon lists web and API access, continuous score refresh, change alerts, and full attack-surface coverage. Pricing is on request; a free plan is not available, though a 30-day trial is offered.
For and against
For
- Continuously monitors vendors across an organization’s ecosystem.
- Prioritizes findings using issue severity and estimated asset value.
- Vendor remediation tracking is available at no cost.
- Offers API integration for cybersecurity and supply-chain risk data.
- The trial includes quick-start guidance and Solutions Consulting access.
Against
- Ratings cover externally visible systems, not internal systems directly.
- There is no free plan.
- Subscription pricing is provided on request.
- The trial lasts 30 days.
The verdict
RiskRecon focuses on vendor ecosystems, asset attribution, and prioritizing remediation, with ratings based on external systems. Organizations should consider that scope when deciding whether it matches their assessment needs.
Who it suits
RiskRecon describes use by third-party risk teams, internal security analysts, M&A teams, CISOs, and boards. Its externally focused ratings may suit organizations seeking visibility into vendor cyber exposure.
Plans and prices
30-day free trial
security ratings for up to 50 vendors · own-organization report · prioritized findings · onboarding guide
Read 15 Oct 2026 · riskrecon.com
Free 30-day portal access
30 days · security ratings for up to 50 vendors · report on your organization · risk-prioritized findings
Read 30 Sep 2026 · riskrecon.com
Paid subscription
pricing varies by vendors monitored, assessment depth and selected features
Read 15 Oct 2026 · upguard.com
RiskRecon subscriptions
Pricing provided in an enrollment form or subscription documentation; contact sales for a quote
Read 30 Sep 2026 · riskrecon.com
On the record
- Accuracy
- RiskRecon says its asset attribution is independently certified to 99.1% accuracy.riskrecon.com · read 30 Sep 2026
- Action plans
- The service automatically creates shareable vendor action plans containing issues that violate the customer’s policy.riskrecon.com · read 15 Oct 2026
- AI assessments
- RiskRecon Assessments uses retrieval-augmented generation to create vendor and SOC 2 summaries and automate questionnaire responses.riskrecon.com · read 15 Oct 2026
- Alliance extensibility
- RiskRecon offers APIs, data feeds and OEM or white-label embedding for technology and managed-service partners.riskrecon.com · read 15 Oct 2026
- API authentication
- The API documentation specifies Bearer JWT authentication and sandbox base URLs.docs.recordedfuture.com · read 15 Oct 2026
- API ecosystem
- Axonius documents a RiskRecon adapter that uses an API key to fetch assets, findings and action-plan findings.docs.axonius.com · read 15 Oct 2026
- API reports
- The API can request executive, summary, detailed and action-plan PDF reports for a target of evaluation.docs.recordedfuture.com · read 15 Oct 2026
- Assessment scope
- RiskRecon assesses externally visible systems, so its ratings reflect an organization’s external posture rather than a direct inspection of internal systems.riskrecon.com · read 30 Sep 2026
- Asset attribution
- RiskRecon says its asset attribution is independently certified at 99.1% accuracy with a false-positive rate below 1%.riskrecon.com · read 15 Oct 2026
- Asset discovery
- Its asset discovery uses analyst-assisted machine-learning models tailored to each monitored company to attribute assets as they change over time.riskrecon.com · read 30 Sep 2026
- Benchmarking
- The platform supports comparing vendor risk performance and benchmarking against peers or industry standards.riskrecon.com · read 15 Oct 2026
- Company facts
- LinkedIn lists RiskRecon by Mastercard as privately held, founded in 2013, headquartered in Salt Lake City and employing 51–200 people.linkedin.com · read 15 Oct 2026
- Company history
- RiskRecon says it was founded by Kelly White and officially incorporated in October 2015.riskrecon.com · read 30 Sep 2026
- Company ownership
- Mastercard announced an agreement to acquire RiskRecon in December 2019, with closing expected in the first quarter of 2020.newsroom.mastercard.com · read 15 Oct 2026
- Continuous monitoring
- The platform continuously assesses vendors instead of relying only on point-in-time questionnaires.riskrecon.com · read 15 Oct 2026
- Custom risk policy
- Customers can tune security criteria and monitoring to their own risk appetite and policy requirements.riskrecon.com · read 15 Oct 2026
- Documentation depth
- Public API documentation includes parameters, enums, response codes, authentication details and example requests.docs.recordedfuture.com · read 15 Oct 2026
- Fourth-party visibility
- RiskRecon can discover and visualize fourth-party entities without requiring additional approvals or permissions.riskrecon.com · read 15 Oct 2026
